Splunk Query Regular Expression

[ramzadabala]

Dear Team,

I've below Splunk log and trying to get stats count based on consumer_application. I've tried below regular expression but no results were returned -

Splunk Query: "uri":* (PaymentVerticle) | rex field=_raw "consumer_application\"\:\"(?P<Consumer>.*?)\"" | stats count by Consumer

Splunk Log 2021-04-22T11:31:25.115912284Z app_name=java message={"name":"PaymentVerticle", "timestamp":"2021-04-22T11:31:25.115Z","level":"info","schemaVersion":"0.1","application":{"name":"PaymentVerticle","version":"1.1.1"},"request":{"address":{"uri":"PaymentVerticle"},"metadata":{"correlation_id":"042320210010GMT"}},"message":"Received request with body {\"payment_request\":{\"consumer_application\":\"BLUEPRISM\"}}"}

[gcusello]

Hi @ramzadabala,

if in your logs you haven't backslashes before ", your regex is correct.

if instead in your logs you have backslashes before " (as in the sample you shared), the regex isn't correct and you have to modify it in this way:

| rex "consumer_application\\\":\\\"(?P<Consumer>.*?)\\\""

 You can test the regex at https://regex101.com/r/us0W8H/1

Ciao.

Giuseppe