Splunk Search

Need help with rex extraction including double quotes and slashes

gamerkhang
New Member

Hi,

I am currently trying to extract the numbers from this field example:

message.data

... {\"MyID\":\"111111\", ...

so I wrote the following rex expression, with no results:

rex field=message.data "\\\"MyID\\\":\\\"(?<MyID>\d+)\\\""

I have tried different amounts of slashes, and I am confident that the section inside the parentheses is correct for my needs.

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

....  | rex field=message.data "\"MyID([^\"]+\"){2}(?<MyID>\d+)"

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

....  | rex field=message.data "\"MyID([^\"]+\"){2}(?<MyID>\d+)"
0 Karma

gamerkhang
New Member

This worked for me. Thanks!

0 Karma

MuS
SplunkTrust
SplunkTrust

Please use the code function while selecting the regex to keep formatting; code can be applied by clicking the 101010 icon or pressing CTRL-k

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...