Splunk Search

Regex to extract field value from a response [See below]

vivekmisra
Observer

I have this result response[sample]:

 

"{\"meta\":{\"code\":400}},[Content-Type:\"application/json\", Transfer-Encoding:\"chunked\", Date:\"Mon, 13 Sep 2021 17:25:12 GMT\", Keep-Alive:\"timeout=60\", Connection:\"keep-alive\"]"

I want value of  field code to be extracted

I tried first to extract json out of this string "{\"meta\":{\"code\":400}},' but it looks i dont need to do these because i just want value of  field code


I tried below but got stuck to remove "/" . 

It would be nice to extract json and get code value but just getting the field code from above will also suffice
| eval responseJson0 = replace(responseJson,"\/", "")
| eval responseJson1 = replace(responseJson,"<", "")
| eval responseJson2 = replace(responseJson1,">", "")
| eval responseJson3 = replace(responseJson2,"200,", "")

Labels (1)
0 Karma

ashvinpandey
Communicator

@vivekmisra use this command in your search string:

| regex field=_raw "code\\\"\:(?P<code>\d+?)}"


Also the extraction logic to extract code value is as below:
code\\\"\:(?P<code>\d+?)}

Also, If this reply helps you, an upvote would be appreciated.

0 Karma

vivekmisra
Observer

Thanks it ia very similar to regular regex but how to have this printed by table.

I also looked https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Rex

So i am trying this :

| rex field=_raw "code\\\"\:(?P<code>\d+?)}"
|table code

Nothing is returned under code. What am I missing?

0 Karma

ashvinpandey
Communicator

@vivekmisra Use this : 

 

| regex field=_raw "code\\\"\:(?P<code>\d+?)}"


Also, If this reply helps you, an upvote would be appreciated.

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!