Splunk Search

New to REX field. How would I go about extracting this data?


I'm trying to track Ringcentral data that we have in Splunk now and the objective is to sort and alert us to missed calls. However the data isn't organized the way I'm used to. This is. a snippet of the event. What I want to do is utilize the rex field to sort by result. These are some of the different results we have.  If you need any information please let me know

"result" : "Missed"
"result" : "Accepted"

"result" : "Call Connected



"duration":39,"type":"Voice","direction":"Inbound","action":"Phone Call","result":"Missed"




Labels (1)
0 Karma


That format is fairly straightforward to parse with rex as long as the field order is constant.

| rex "duration\\\":(?<duration>\d+),\\\"type\\\":\\\"(?<type>[^\\\"]+)\\\",\\\"direction\\\":\\\"(?<direction>[^\\\"]+)\\\",\\\"action\\\":\\\"(?<action>[^\\\"]+)\\\",\\\"result\\\":\\\"(?<result>[^\\\"]+)"

The "extra" backslashes are there to escape the embedded quotation marks.

If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.