Splunk Search

Regex Help

Observer

Hello all,

I am new to regex and struggling to get the Actual value field. I only need the number in between the quotes as sometimes the number can be smaller or larger than the example in the event. Below is an example of what I was trying with no luck. Any help is appreciated.
| rex "\svalue\":(?\d+)"

Message={
"ApplicationId": "babe7022-5a00-4338-a519-0a5bbf5c64ee",
"ApplicationName": "Lacerte 2019",
"Measurement": "lacerteload_2019",
"Description": "Measurement duration (59.615s) exceeded threshold of 40s (49.04%)",
"Actual value": "59.615",

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try | rex "value\\": \\"(?<actualValue>[^\\"]+)".

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Motivator

There is a often overlooked utility that is extremely useful for these type situations..."erex".

Run your existing search and pipe the results to erex, give the field a name, and provide an example value.

e.g.
| erex ApplicationId examples="babe7022-5a00-4338-a519-0a5bbf5c64ee"

When the search returns, go to the job inspector and it will provide the regex that Splunk used to find the value.
You can also use "counterexamples" to eliminate matches.

It's a very handy tool.

Documentation:
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Erex

0 Karma

SplunkTrust
SplunkTrust

Try | rex "value\\": \\"(?<actualValue>[^\\"]+)".

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Observer

no such luck. It returned Error in 'SearchParser': Missing a search command before '^'. Error at position '107' of search query 'search index="login_pi" source="WinEventLog:LoginP...{snipped} {errorcontext = (?[^\"]+)"}'.

0 Karma

SplunkTrust
SplunkTrust

There was a typo and extra escape characters were needed. Try the updated answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!