Splunk Search

Should be simple but it's not for me regex

dcase9999
Engager

Hi,

 

I have the below string and I'm trying to extract out the downstream status code by using this expression.  I used to do this a long time ago but it appears those brain cells have aged out.

 

Regex that works in regex 101 but not Splunk

 

rex "DownstreamStatus..(?<dscode>\d+)"|stats count by dscode

 



String

 

 {"ClientAddr":"blah","ClientHost":"blah","ClientPort":"50721","ClientUsername":"-","DownstreamContentSize":11,"DownstreamStatus":502,"Duration":179590376953,"OriginContentSize":11,"OriginDuration":179590108721,"OriginStatus":502,"Overhead":268232,

 

 

Labels (1)
0 Karma
1 Solution

dcase9999
Engager

argh!!!  Stupid me forgot the field argument.......  Now it works, sorry everyone.

 

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Although you can get rex to work to some extent, treating structure data such as JSON as string is not robust.  I always recommend changing to Splunk's tested builtin functions such as spath or fromjson.

If your event is JSON, Splunk should have given you the data field unless there's some serious problem with event parsing.  If the string snippet is part of a data field that contains compliant JSON, say data, just do

| spath input=data

If the snippet is not in a field yet, use rex to extract the entire compliant JSON, then use spath.  You will have much better data to work with.

0 Karma

dcase9999
Engager

argh!!!  Stupid me forgot the field argument.......  Now it works, sorry everyone.

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...