Splunk Search

New to REX field. How would I go about extracting this data?

msage
Path Finder

I'm trying to track Ringcentral data that we have in Splunk now and the objective is to sort and alert us to missed calls. However the data isn't organized the way I'm used to. This is. a snippet of the event. What I want to do is utilize the rex field to sort by result. These are some of the different results we have.  If you need any information please let me know

"result" : "Missed"
"result" : "Accepted"

"result" : "Call Connected

 

 

"duration":39,"type":"Voice","direction":"Inbound","action":"Phone Call","result":"Missed"

 

 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That format is fairly straightforward to parse with rex as long as the field order is constant.

| rex "duration\\\":(?<duration>\d+),\\\"type\\\":\\\"(?<type>[^\\\"]+)\\\",\\\"direction\\\":\\\"(?<direction>[^\\\"]+)\\\",\\\"action\\\":\\\"(?<action>[^\\\"]+)\\\",\\\"result\\\":\\\"(?<result>[^\\\"]+)"

The "extra" backslashes are there to escape the embedded quotation marks.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...