Splunk Search

Regex Working in Regex Tester But Not in Splunk

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

I've put together this regex which works perfectly in Regex101:

\"loggedInAt":\"(?<LoggedIn>[^\"]+)

This correctly extracts the 'loggedInAt' value from the raw data as shown below:

{"uri":"/auth/oid/4a1f00001b00002eb5","loggedInAt":"2015-10-18T18:30:34.976Z","credentials":{"gatewayId":"0000000"},"accounts":{"iht":{"link":"/iht/AA112456","nino":"AA111111A"},"sa":{"link":"/individual/12345678","ur":12345678"},"taxs":{"link":"/taxs/12345678","ur":"12345678"}},"lastUpdated":"2015-10-18T18:30:34.976Z","levelOfAssurance":"2","confidenceLevel":500}.

I then use this line in my Splunk query.

| rex field="detail.authority" ""\"loggedInAt":\"(?<LoggedIn>[^\"]+)"

The problem I have is that when I come to add "LoggedIn" to my table the relevant information is not being extracted and I'm nit sure why.

I just wondered whether someone could look a this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

Tags (2)
0 Karma
1 Solution

vincenteous
Communicator

Hi Chris,

I think I've found where your problem is. It's just the matter of placing the double quote character. Your rex was like this:

.. | rex field="detail.authority" ""\"loggedInAt":\"(?<LoggedIn>[^\"]+)"

I tried in my local environment using your sample data and it clearly was not working. So, I altered the rex into something like this:

.. | rex field="detail.authority" "\"loggedInAt\":\"(?<LoggedIn>[^\"]+)\""

The things I've tweaked are:

  1. Remove the first double quote
  2. Add backslash to the double quote after loggedInAt
  3. Add backslash to the last double quote and add another double quote at the end

This should solve your problem.

Best Regards

View solution in original post

0 Karma

vincenteous
Communicator

Hi Chris,

I think I've found where your problem is. It's just the matter of placing the double quote character. Your rex was like this:

.. | rex field="detail.authority" ""\"loggedInAt":\"(?<LoggedIn>[^\"]+)"

I tried in my local environment using your sample data and it clearly was not working. So, I altered the rex into something like this:

.. | rex field="detail.authority" "\"loggedInAt\":\"(?<LoggedIn>[^\"]+)\""

The things I've tweaked are:

  1. Remove the first double quote
  2. Add backslash to the double quote after loggedInAt
  3. Add backslash to the last double quote and add another double quote at the end

This should solve your problem.

Best Regards

0 Karma

IRHM73
Motivator

Hi @vincenteous, thank you very much for this it works a treat.

Kind Regards

Chris

0 Karma

dkoops
Path Finder

Splunk has some issues with double quotes inside double quotes, at least thats what I've experienced before. Therefore I always try to avoid using them in rexes. Try this one:

| rex "loggedInAt\W\:\W(?<VALUE>.*?)\W,"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...