Splunk Search

New to REX field. How would I go about extracting this data?

msage
Explorer

I'm trying to track Ringcentral data that we have in Splunk now and the objective is to sort and alert us to missed calls. However the data isn't organized the way I'm used to. This is. a snippet of the event. What I want to do is utilize the rex field to sort by result. These are some of the different results we have.  If you need any information please let me know

"result" : "Missed"
"result" : "Accepted"

"result" : "Call Connected

 

 

"duration":39,"type":"Voice","direction":"Inbound","action":"Phone Call","result":"Missed"

 

 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That format is fairly straightforward to parse with rex as long as the field order is constant.

| rex "duration\\\":(?<duration>\d+),\\\"type\\\":\\\"(?<type>[^\\\"]+)\\\",\\\"direction\\\":\\\"(?<direction>[^\\\"]+)\\\",\\\"action\\\":\\\"(?<action>[^\\\"]+)\\\",\\\"result\\\":\\\"(?<result>[^\\\"]+)"

The "extra" backslashes are there to escape the embedded quotation marks.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!