Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Regex Help
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Struggling yet again with another regex. The sample string looks like the following:
.........,"errorCode":"500113"}, .......
As part of a whole JSON response.
If I take that JSON and put it into regex101, I can use the following rex to correctly capture the code
"errorCode\":(.*?)},
However, I'm not sure how to turn that into a rex command to parse out the field. If I simply replace the .* with ?<> with a field name inside the brackets it errors out, and in fact I can't ever get it to not throw an error.
How do I turn an accurate regular expression(at least from my testing using online regular expression tools) into a rex command to capture a field in Splunk?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Don't replace .* with ?<fieldName>. You add ?<fieldName> after your (, like:
"errorCode\":(?<errorCode>.*?)},
Full rex (alteration to exclude double quotes from the extracted value):
| rex "\"errorCode\":\"(?<errorCode>.*?)\"},"
Probably better version, which specifies that errorCode can't contain ":
| rex "\"errorCode\":\"(?<errorCode>[^\"]+)\"},"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Don't replace .* with ?<fieldName>. You add ?<fieldName> after your (, like:
"errorCode\":(?<errorCode>.*?)},
Full rex (alteration to exclude double quotes from the extracted value):
| rex "\"errorCode\":\"(?<errorCode>.*?)\"},"
Probably better version, which specifies that errorCode can't contain ":
| rex "\"errorCode\":\"(?<errorCode>[^\"]+)\"},"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ahh, thanks for the explanation! Works perfectly. Appreciate the help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The feeling you have when you are too late to a regex question :S
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
