Splunk Search

Rex field list of strings

tjdevries
Loves-to-Learn Lots

How do I extract all values from a json file containing a list with multiple strings with rex?

The content of the field contains a list and a variable in stringform. 

The number of items in the list can vary and the length of items also. 

The field is as follows:

"{\"variable2\":[\"AB1234\",\"BA1234\",\"DCBA\",\"ABCD\"],\"name\":\"namegiven\"}

In sofar, I was able to extract the field name with the following query.

| rex field=field.subfield.body max_match=0 "\"name\"\:\"(?<name>[a-zA-Z]+)\""

Variable 2 is a list with multiple strings and this leaves me puzzled. It's not the expression to recognize the strings in the list, but I'm looking for a way to look inside the list, look for two different patterns and find all items in it. 

Can someone help out?

Labels (2)
Tags (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

 

With  structured data like JSON, it is less desirable to use Rex for extraction.  Have you considered spath instead?

| makeresults ``` emulation ```
| eval myfield = "{\"variable2\":[\"AB1234\",\"BA1234\",\"DCBA\",\"ABCD\"],\"name\":\"namegiven\"}"


| spath input=myfield

 

 

 

 

 

 

 

Tags (1)
0 Karma

tjdevries
Loves-to-Learn Lots

Not yet but it looks a good approach to look into. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

May I suggest extracting the fields with rex and then parsing them in a separate command?  Perhaps this will get you started.

| makeresults | eval _raw="{\"variable2\":[\"AB1234\",\"BA1234\",\"DCBA\",\"ABCD\"],\"name\":\"namegiven\"}"
```Above just sets up test data```
| rex "variable2\\\":\[(?<variable2>[^\]]+)],\\\"name\\\":\\\"(?<name>[a-zA-Z]+)"
| eval variable2=split(variable2,",")
...
---
If this reply helps you, Karma would be appreciated.
0 Karma

tjdevries
Loves-to-Learn Lots

I managed to extract one field from the variable2-field. In some cases, it picks-up a 4-character-string, if a 6-character string is not present although I added match=0 to the query. 

The cause looks that the order of the six-character and four-character strings within the list is unsorted. So this makes it more complicated. 

 

Do you have a suggestion to approach this? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the data is proper JSON, consider @yuanliu's suggestion and try the spath command.

I'm puzzled a bit by the latest response.  The regex doesn't care about the size of the strings, it just pulls everything from between the square brackets that follow "variable2".  Can you share actual events and search results (sanitized, of course)?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...