Proper Rex expression help

[nkavouris]

I need help building a proper rex expression to extract the bold text from the following raw data

{"bootcount":8,"device_id":"XXXX","environment":"prod_walker","event_source":"appliance","event_type":"GENERIC","local_time":"2025-02-20T00:34:58.406-06:00",
"location":{"city":"XXXX","country":"XXXX","latitude":XXXX,"longitude":XXXX,"state":"XXXX"},"log_level":"info",
"message":"martini::hardware_controller: Unit state update from cook client target: Elements(temp: 500°F, [D, D, D, D, D, F: 0]), hw_state: Elements(temp: 500°F, [D, D, D, D, D, F: 115])\u0000",
"model_number":"XXXX","sequence":372246,"serial":"XXXX","software_version":"2.3.0.276","ticks":0,"timestamp":1740033298,"timestamp_ms":1740033298406}

 I have tried;

rex field=message "(?=[^h]*(?:hw_state:|h.*hw_state:))^(?:[^\(\n]*\(){2}\w+:\s+(?P<set_temp>\d+)
rex field=message ".*hw_state: Elements\(temp:(?<set_temp>\d+),.*"|

 with no results yielded. What is the proper rex expression to extract 500 from the message field

[yuanliu]

This is a JSON object (except you should add quotes to those bare XXXX).  Do not use regex on structured data.  See the other thread you started.  Your search is inefficient because you use wildcard at the beginning of a term.  And there's a solution to that.

[gcusello]

Hi @nkavouris,

please try this:

| rex "hw_state:\sElements\(temp:\s(?<temp>\d+)"

that you can test at https://regex101.com/r/FhThZf/1

Ciao.

Giuseppe

[nkavouris]

Grazie giuseppe, but this does not work in splunk unfortunately

[gcusello]

Hi @nkavouris ,

what's the behavior of this regex: it extract too data or nothing?

it seems to be correct using the sample you shared.

Anyway, this seems to be a log in json format, did you tried to use INDEXED_EXTRACTIONS=JSON or spath?

Ciao.

Giuseppe

[nkavouris]

No data extracted at all, and the data is JSON formatted.

I normally start my rex expressions with field=message "(rex expression)"

[livehybrid]

Hi @nkavouris 

Is it just "500" you are expecting to extract?

Your second regex looks pretty close but you are missing the \s for the space after : and before 500 - and a couple of other tweaks. Does this work for you?

| rex field=message "Elements\(temp:\s(?<set_temp>\d+)"

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will