Splunk Search

To extract string value using regex

parthiban
Path Finder

Hi Team,

I want to extract the below field value, here the challenge is the error code 403 sometimes it will change.

"processing_stage": "Getting a response of 403 from CRM Lead"

 

Kindly help me to extract the message using regex or any option available.

Labels (3)
0 Karma

parthiban
Path Finder

Hi @gcusello 

It is not working as expected, I need to extract full string

parthiban_0-1709554414427.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @parthiban,

you hughlighted only the 403 response code, if you want the full string, you could use:

| rex "\"processing_stage\": \"(?<response>[^\"]+)"

that you can test at https://regex101.com/r/mz4c1L/2 

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @parthiban,

if the message string is fixed, you could try:

<your_search> 
| rex "\"Getting a response of (?<response>\d+)"
| table ...

you can test this regex at https://regex101.com/r/mz4c1L/1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...