Splunk Search

To extract a field using the REX Command

Real_captain
Explorer

Hello

I want to extract the field issrDsclsrReqId" using the Rex command. 

Can someone please help me with the command to extract the value of field bizMsgIdr  which is eiifr000005229220231229162227. 

 

{ "shrhldrsIdDsclsrRspn": { "dsclsrRspnId": "0000537ede1c5e1084490000aa7eefab", "issrDsclsrReqRef": { "issrDsclsrReqId": "eiifr000005229220231229162227", "finInstrmId": { "isin": "FR0000052292" }, "shrhldrsDsclsrRcrdDt": { "dt": { "dt": "2023-12-29" } } }, "pgntn": { "lastPgInd": true, "pgNb": "1" }, "rspndgIntrmy": { "ctctPrsn": { "emailAdr": "ipb.asset.servicing@bnpparibas.com", "nm": "IPB ASSET SERVICING" }, "id": { "anyBIC": "BNPAGB22PBG" }, "nmAndAdr": { "adr": { "adrTp": 0, "bldgNb": "10", "ctry": "GB", "ctrySubDvsn": "LONDON", "pstCd": "NW16AA", "strtNm": "HAREWOOD AVENUE", "twnNm": "LONDON" }, "nm": "BNP PARIBAS PRIME BROKERAGE" } } } }

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

How about this

| makeresults
| eval Properties.appHdr = "{
  \"fr\": {
    \"fiId\": {
      \"finInstnId\": {
        \"bicfi\": \"BNPAGB22PBG\"
      }
    }
  },
  \"to\": {
    \"fiId\": {
      \"finInstnId\": {
        \"bicfi\": \"SICVFRPPEII\"
      }
    }
  },
  \"bizMsgIdr\": \"res1caf3c2ac2b3b6d180ff0001aa7eefab\",
  \"msgDefIdr\": \"seev.047.001.02\",
  \"creDt\": \"2024-01-11T21:03:56.000Z\"
}"
| fields - _time
```Generate test event```
| spath input=Properties.appHdr
| table bizMsgIdr *

View solution in original post

0 Karma

Real_captain
Explorer

Both these options are not working and splunk is not able to extract the bizMsgIdr from the field Properties.appHdr . 

Can you please provide some other way to extract this text. 

 

Real_captain_0-1705307484920.png

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

How about this

| makeresults
| eval Properties.appHdr = "{
  \"fr\": {
    \"fiId\": {
      \"finInstnId\": {
        \"bicfi\": \"BNPAGB22PBG\"
      }
    }
  },
  \"to\": {
    \"fiId\": {
      \"finInstnId\": {
        \"bicfi\": \"SICVFRPPEII\"
      }
    }
  },
  \"bizMsgIdr\": \"res1caf3c2ac2b3b6d180ff0001aa7eefab\",
  \"msgDefIdr\": \"seev.047.001.02\",
  \"creDt\": \"2024-01-11T21:03:56.000Z\"
}"
| fields - _time
```Generate test event```
| spath input=Properties.appHdr
| table bizMsgIdr *
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's generally not the best idea to manipulate structured data with regexes if you can use the built-in functionality for handling the structure - like spath command or auto-kv functionality. Even if your data is guaranteed to be simple (you will never have an array or subobject as value), you don't have to worry of finding proper field boundaries, escaping and so on.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

why not this way?

| makeresults 
| eval _raw = "{ \"shrhldrsIdDsclsrRspn\": { \"dsclsrRspnId\": \"0000537ede1c5e1084490000aa7eefab\", \"issrDsclsrReqRef\": { \"issrDsclsrReqId\": \"eiifr000005229220231229162227\", \"finInstrmId\": { \"isin\": \"FR0000052292\" }, \"shrhldrsDsclsrRcrdDt\": { \"dt\": { \"dt\": \"2023-12-29\" } } }, \"pgntn\": { \"lastPgInd\": true, \"pgNb\": \"1\" }, \"rspndgIntrmy\": { \"ctctPrsn\": { \"emailAdr\": \"ipb.asset.servicing@bnpparibas.com\", \"nm\": \"IPB ASSET SERVICING\" }, \"id\": { \"anyBIC\": \"BNPAGB22PBG\" }, \"nmAndAdr\": { \"adr\": { \"adrTp\": 0, \"bldgNb\": \"10\", \"ctry\": \"GB\", \"ctrySubDvsn\": \"LONDON\", \"pstCd\": \"NW16AA\", \"strtNm\": \"HAREWOOD AVENUE\", \"twnNm\": \"LONDON\" }, \"nm\": \"BNP PARIBAS PRIME BROKERAGE\" } } } }"
``` generate test data``` 
| spath
| table shrhldrsIdDsclsrRspn.issrDsclsrReqRef.issrDsclsrReqId

If needed you can also use spath function with eval.

If you really want to use rex then this should work

| makeresults 
| eval _raw = "{ \"shrhldrsIdDsclsrRspn\": { \"dsclsrRspnId\": \"0000537ede1c5e1084490000aa7eefab\", \"issrDsclsrReqRef\": { \"issrDsclsrReqId\": \"eiifr000005229220231229162227\", \"finInstrmId\": { \"isin\": \"FR0000052292\" }, \"shrhldrsDsclsrRcrdDt\": { \"dt\": { \"dt\": \"2023-12-29\" } } }, \"pgntn\": { \"lastPgInd\": true, \"pgNb\": \"1\" }, \"rspndgIntrmy\": { \"ctctPrsn\": { \"emailAdr\": \"ipb.asset.servicing@bnpparibas.com\", \"nm\": \"IPB ASSET SERVICING\" }, \"id\": { \"anyBIC\": \"BNPAGB22PBG\" }, \"nmAndAdr\": { \"adr\": { \"adrTp\": 0, \"bldgNb\": \"10\", \"ctry\": \"GB\", \"ctrySubDvsn\": \"LONDON\", \"pstCd\": \"NW16AA\", \"strtNm\": \"HAREWOOD AVENUE\", \"twnNm\": \"LONDON\" }, \"nm\": \"BNP PARIBAS PRIME BROKERAGE\" } } } }"
``` generate test data``` 
| rex "\"issrDsclsrReqId\"\s*:\s*\"(?<issrDsclsrReqId>[^\"]+)\""
| table  issrDsclsrReqId

 r. Ismo

0 Karma

Real_captain
Explorer

This is not working and no result in the column issrDsclsrReqId. 

Is it possible to extract the value of  "bizMsgIdr": from the field Properties.appHdr

Splunk COmmand : 

`macro_events_prod_srt_shareholders_esa` sourcetype ="mscs:azure:eventhub" Name="Received Disclosure Response Command" "res1caf3c2ac2b3b6d180ff0001aa7eefab".

 

Result in the column Properties.appHdr : 

{
"fr": {
"fiId": {
"finInstnId": {
"bicfi": "BNPAGB22PBG"
}
}
},
"to": {
"fiId": {
"finInstnId": {
"bicfi": "SICVFRPPEII"
}
}
},
"bizMsgIdr": "res1caf3c2ac2b3b6d180ff0001aa7eefab",
"msgDefIdr": "seev.047.001.02",
"creDt": "2024-01-11T21:03:56.000Z"
}

 

Real_captain_0-1705075471568.png

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

If this is json, like you already has, it's easier and better to use spath to extract those. 

Based on your screenshot you should have this already on field Properties.appHdr.bizMsgIdr . In that case you can try e.g 

...
|rename Properties.appHdr.bizMsgIdr as bizMsgIdr

if you really need to rename/use short version. Another option is use

...
| eval bizMsgIdr = Properties.appHdr.bizMsgIdr

 

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...