Splunk Search

Need the correct regular expression for my rex command

moizmmz
Path Finder

Here is my event's raw data:

{"line":"level=info t=\"2019-01-29T18:19:42.999Z\" rt=2 method=GET path=\"/contentskus/5b7ee52a4f6b9c001b049ac3?dma=999\u0026itemsPerPage=25\u0026page=1\" sc=200 dma=999 apikey=DEFAULT amzn_trace_id=unknown enabledFeatures=recommendations,upcomingSearch,popularityQueriesPlatformSpecific,availabilityTimes,avoidDefaultQuery,useFavoritesExternalSchemaForD2C,useFavoritesV2ForFavoritesFilter,endCardRecommendations,cmsAuthFallback os=2 rid=\"6962240ed296c770\" mode=published","source":"stdout","tag":"ecs-uat_admin_v1sandbox_blue-35-uat-service-admin-d8d0a7a0c2dfe8ea6c00/503343765eaa","attrs":{"SERVICE_NAME":"admin","SERVICE_TAGS":"contentgroups,contentsettings,contentskus,metatags,settings,userroles,users,s3signurl","SERVICE_VERSION":"v1sandbox","com.amazonaws.ecs.task-arn":"arn:aws:ecs:us-west-2:776609208984:task/305f6e5a-d20d-4aa2-877d-1bba2d442a7b"}}

I'm trying to create a new field called service_name where I extract the highlighted portion in the above event. The regukar expression that I wrote is: \W\W\W[e][c][s]\S(?\w{1,})

Achieved result: uat_admin_v1sandbox_blue
Expected result: admin_v1sandbox_blue

Please help!!!

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @moizmmz

Does this work for you: \"tag\":\"[^\-]+\-[^\_]+\_([^\-]+)

https://regex101.com/r/XFwLwU/1/

Good luck :slightly_smiling_face:

View solution in original post

saurabh009
Path Finder

The easiest way to check for any regular expression is using splunk extract fields. Its quite powerful and gives almost exact extraction.
you can see the regular expression used and apply the same in your query using "rex " command.

0 Karma

moizmmz
Path Finder

problem is, the events don't load in the sample events slot more than half the time

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @moizmmz

Does this work for you: \"tag\":\"[^\-]+\-[^\_]+\_([^\-]+)

https://regex101.com/r/XFwLwU/1/

Good luck :slightly_smiling_face:

moizmmz
Path Finder

Perfect! thank you!

0 Karma

moizmmz
Path Finder

Can you pls explain this part: [^-]+-[^_]+_([^-]+) ??

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

It means any characters except for hypon
then a hyphon
then anything except for an underscore
Then an underscore
Then capture everything until a hyphon

0 Karma

moizmmz
Path Finder

Awesome!!! thanks!!!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...