Should be simple but it's not for me regex

[dcase9999]

Hi,

I have the below string and I'm trying to extract out the downstream status code by using this expression.  I used to do this a long time ago but it appears those brain cells have aged out.

Regex that works in regex 101 but not Splunk

rex "DownstreamStatus..(?<dscode>\d+)"|stats count by dscode

String

 {"ClientAddr":"blah","ClientHost":"blah","ClientPort":"50721","ClientUsername":"-","DownstreamContentSize":11,"DownstreamStatus":502,"Duration":179590376953,"OriginContentSize":11,"OriginDuration":179590108721,"OriginStatus":502,"Overhead":268232,

[yuanliu]

Although you can get rex to work to some extent, treating structure data such as JSON as string is not robust.  I always recommend changing to Splunk's tested builtin functions such as spath or fromjson.

If your event is JSON, Splunk should have given you the data field unless there's some serious problem with event parsing.  If the string snippet is part of a data field that contains compliant JSON, say data, just do

| spath input=data

If the snippet is not in a field yet, use rex to extract the entire compliant JSON, then use spath.  You will have much better data to work with.

[dcase9999 · Accepted solution]

argh!!!  Stupid me forgot the field argument.......  Now it works, sorry everyone.