Regex Working in Regex Tester But Not in Splunk

[IRHM73]

Hi, I wonder whether someone may be able to help me please.

I've put together this regex which works perfectly in Regex101:

\"loggedInAt":\"(?<LoggedIn>[^\"]+)

This correctly extracts the 'loggedInAt' value from the raw data as shown below:

{"uri":"/auth/oid/4a1f00001b00002eb5","loggedInAt":"2015-10-18T18:30:34.976Z","credentials":{"gatewayId":"0000000"},"accounts":{"iht":{"link":"/iht/AA112456","nino":"AA111111A"},"sa":{"link":"/individual/12345678","ur":12345678"},"taxs":{"link":"/taxs/12345678","ur":"12345678"}},"lastUpdated":"2015-10-18T18:30:34.976Z","levelOfAssurance":"2","confidenceLevel":500}.

I then use this line in my Splunk query.

| rex field="detail.authority" ""\"loggedInAt":\"(?<LoggedIn>[^\"]+)"

The problem I have is that when I come to add "LoggedIn" to my table the relevant information is not being extracted and I'm nit sure why.

I just wondered whether someone could look a this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

[vincenteous · Accepted solution]

Hi Chris,

I think I've found where your problem is. It's just the matter of placing the double quote character. Your rex was like this:

.. | rex field="detail.authority" ""\"loggedInAt":\"(?<LoggedIn>[^\"]+)"

I tried in my local environment using your sample data and it clearly was not working. So, I altered the rex into something like this:

.. | rex field="detail.authority" "\"loggedInAt\":\"(?<LoggedIn>[^\"]+)\""

The things I've tweaked are:

1. Remove the first double quote
2. Add backslash to the double quote after loggedInAt
3. Add backslash to the last double quote and add another double quote at the end

This should solve your problem.

Best Regards

[IRHM73]

Hi @vincenteous, thank you very much for this it works a treat.

Kind Regards

Chris

[dkoops]

Splunk has some issues with double quotes inside double quotes, at least thats what I've experienced before. Therefore I always try to avoid using them in rexes. Try this one:

| rex "loggedInAt\W\:\W(?<VALUE>.*?)\W,"