Splunk Search

Re: Help on removing the double quotes and reading a substring

manojchacko78
Path Finder

Hi @gcusello 

Need one more help, from the below log, i am able to remove all the wild characters using below script, but need to retain the commas in the texts (in italics) between  Message and Details, similarly for Message and Success

Appreciate the help

| eval "EM"=if(isnotnull('cip:AuditMessage.MessageText'),'cip:AuditMessage.MessageText',"Data Not Found")
| rex field=EM max_match=0 "(?<ErrMes>\w+)"
| eval ErrorMessage = mvjoin (ErrMes, " ")
| rex field=ErrorMessage Message\s+(?<ErrorResponse>.*)\s+Details\s+Message\s+(?<ErrorResponse2>.*)\s+Success

{"@odata.context":"https://apistaging.payspace.com/odata/v1.0/11997/$metadata#Employee/$entity","Message":"The Nationality field is required., The Province field is required., The Code field is required., The Country field is required.","Details":[{"Message":"The Nationality field is required."},{"Message":"The Province field is required."},{"Message":"The Code field is required."},{"Message":"The Country field is required."}],"Success":false}

 

 

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @manojchacko78,

let me understand: you want to remove commas having one message field or you want four messages?

in the first case, you can use replace

| rex "\"Message\":\"(?<Full_Message>[^\"]+)\",\"Details"
| replace "," WITH ""

if instead you want four messages you have to use two regexes, please try this regex:

| rex "\"Message\":\"(?<Full_Message>[^\"]+)\",\"Details"
| rex field=Full_Message "((^)|(,\s+))(?<Message>[^\.]+)"

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @manojchacko78,

this isn't naother question, anyway, could you share the desidered output?

Ciao.

Giuseppe

0 Karma

SinghK
Builder

I have moved the post to new post. 

@manojchacko78  please ask new questions in separate posts. 

 

regards,

Singhk

0 Karma

manojchacko78
Path Finder

Hi @gcusello 

Thanks for the reply

This is what i am getting as raw

{"@odata.context":"https://url.com","Message":"The Nationality field is required., The Province field is required., The Code field is required., The Country field is required.","Details":[{"Message":"The Nationality field is required."},{"Message":"The Province field is required."},{"Message":"The Code field is required."},{"Message":"The Country field is required."}],"Success":false}

Now the bold text above is the desired output i am trying to extract. This bold texts always comes between these two words Message":" and ","Details

Kindly advise

 

0 Karma

manojchacko78
Path Finder

Now as the below code, all the wild characters are removed

| eval "EM"=if(isnotnull('cip:AuditMessage.MessageText'),'cip:AuditMessage.MessageText',"Data Not Found")
| rex field=EM max_match=0 "(?<ErrMes>\w+)"
| eval ErrorMessage = mvjoin (ErrMes, " ")
| rex field=ErrorMessage Message\s+(?<ErrorResponse>.*)\s+Details

I am getting the extracted message, so these are basically 4 error messages separated by commas, but since i am removing all the wild characters the comma is gone. So the commas should be extracted as it is

The Nationality field is required The Province field is required The Code field is required The Country field is required

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manojchacko78,

let me understand: you want to remove commas having one message field or you want four messages?

in the first case, you can use replace

| rex "\"Message\":\"(?<Full_Message>[^\"]+)\",\"Details"
| replace "," WITH ""

if instead you want four messages you have to use two regexes, please try this regex:

| rex "\"Message\":\"(?<Full_Message>[^\"]+)\",\"Details"
| rex field=Full_Message "((^)|(,\s+))(?<Message>[^\.]+)"

Ciao.

Giuseppe

manojchacko78
Path Finder

This one worked like a gem

| rex "\"Message\":\"(?<Full_Message>[^\"]+)\",\"Details"

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manojchacko78,

please try thi regex:

\"Message\":\"(?<Message>[^\"]+)\",\"Details

that you can test at https://regex101.com/r/8zMJIf/1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...