Splunk Search
Highlighted

Need help in field extraction

Path Finder

In the below log, I need to extract genres from the log. In a single log there are multiple genres. Such as for the below log , we have 3 genres ---( Comedy, Drama and Romance).

My requirement is to map genres with ID.

0,"[{""id"": 35, ""name"": ""Comedy""}, {""id"": 18, ""name"": ""Drama""}, {""id"": 10749, ""name"": ""Romance""}, {""id"": 10770, ""name"": ""TV Movie""}]",http://www.hallmarkchannel.com/signedsealeddelivered,231617,"[{""id"": 248, ""name"": ""date""}, {""id"": 699, ""name"": ""love at first sight""}, {""id"": 2398, ""name"": ""narration""}, {""id"": 5340, ""name"": ""investigation""}, {""id"": 34051, ""name"": ""team""}, {""id"": 173066, ""name"": ""postal worker""}]",en,"Signed, Sealed, Delivered","""Signed, Sealed, Delivered"" introduces a dedicated quartet of civil servants in the Dead Letter Office of the U.S. Postal System who transform themselves into an elite team of lost-mail detectives. Their determination to deliver the seemingly undeliverable takes them out of the post office into an unpredictable world where letters and packages from the past save lives, solve crimes, reunite old loves, and change futures by arriving late, but always miraculously on time.",1.444476,"[{""name"": ""Front Street Pictures"", ""id"": 3958}, {""name"": ""Muse Entertainment Enterprises"", ""id"": 6438}]","[{""iso31661"": ""US"", ""name"": ""United States of America""}]",2013-10-13,0,120,"[{""iso6391"": ""en"", ""name"": ""English""}]",Released,,"Signed, Sealed, Delivered",7.0,6

Highlighted

Re: Need help in field extraction

SplunkTrust
SplunkTrust

@vikcee

Full sample event in code block and expected out will help us to address your issue.

0 Karma
Highlighted

Re: Need help in field extraction

Communicator

Hi Vikcee,

Please try the below regex. Hope this helps you to find it.

rex field=_raw """(?P[A-Z][a-z]+)"""

0 Karma
Highlighted

Re: Need help in field extraction

Builder

Looks like JSON - what happens if you tell Splunk to ingest your sample as JSON?

0 Karma
Highlighted

Re: Need help in field extraction

Legend

Hi vikcee,
try something like this:

| rex "\{\"\"\w+\"\":\s+\w+,\s+\"\"\w+\"\":\s\"\"(?<genres>[^\"]*)"

that you can test at https://regex101.com/r/ERdRYl/1

Ciao.
Giuseppe

0 Karma
Highlighted

Re: Need help in field extraction

Esteemed Legend

Try this:

... | rex max_match=3 "{\"\"id\"\":\s+\d+,\s+\"\"name\"\":\s+\"\"(?<genre>[A-Z][^\"]+)\"\"},"

See here:
https://regex101.com/r/16Cvhv/1

View solution in original post

0 Karma
Highlighted

Re: Need help in field extraction

Path Finder

Thanks Sir..

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.