Regex Help

[tkerr1357]

Hello all,

I am new to regex and struggling to get the Actual value field. I only need the number in between the quotes as sometimes the number can be smaller or larger than the example in the event. Below is an example of what I was trying with no luck. Any help is appreciated.
| rex "\svalue\":(?\d+)"

Message={
"ApplicationId": "babe7022-5a00-4338-a519-0a5bbf5c64ee",
"ApplicationName": "Lacerte 2019",
"Measurement": "lacerteload_2019",
"Description": "Measurement duration (59.615s) exceeded threshold of 40s (49.04%)",
"Actual value": "59.615",

[codebuilder]

There is a often overlooked utility that is extremely useful for these type situations..."erex".

Run your existing search and pipe the results to erex, give the field a name, and provide an example value.

e.g.
| erex ApplicationId examples="babe7022-5a00-4338-a519-0a5bbf5c64ee"

When the search returns, go to the job inspector and it will provide the regex that Splunk used to find the value.
You can also use "counterexamples" to eliminate matches.

It's a very handy tool.

Documentation:
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex

[richgalloway · Accepted solution]

Try | rex "value\\": \\"(?<actualValue>[^\\"]+)".

[tkerr1357]

no such luck. It returned Error in 'SearchParser': Missing a search command before '^'. Error at position '107' of search query 'search index="login_pi" source="WinEventLog:LoginP...{snipped} {errorcontext = (?[^\"]+)"}'.

[richgalloway]

There was a typo and extra escape characters were needed. Try the updated answer.