I wrote a regular expression to extract fields from an event containing data in the JSON format. The regular expression seems to be working fine on https://regex101.com/ but I am not able to transform extracted fields in the tabular format.
Below is the query with regular expression:
index="index_name" "<search term>" | rex field=_raw "\"(errorId)\":(?<errorId>.*),\"(errorMessage)\":(?<errorMessage>.*),\"(exceptionStackTrace)\":(?<exceptionStackTrace>.*),\"(userId)\":(?<userId>.*),\"(requestUri)\":(?<requestUri>.*)}"
Below is the extended query to transform it into a table:
Thanks for replying. The regular expression you have shared is working fine on https://regex101.com/ and returns the fields without double quotes. But not able to see data in the table. The same issue still persists.
Are you saying that the rex works in search and returns data in the fields but the table command removes all the events, or that the expression works in regex101 and extracts the fields correctly there but not with your real data in splunk search? Does your real data perhaps include white spaces which are not present in your example?