Splunk Search

Unable to create field using regex

sagar_shubham
Explorer

Hi Team, 

 

Need your help in creating regex to create a field. 

"User_Claim":("sub":"qweihaytej"; "login_id":"Abc@domain.com";........) 

Here User_Claim is a field. I have to create a field for login_id.

I have tried with this, and it's not working. 

..... | rex field=User_Claim " login_id"(? <loginID>\w+.) "

I am unable to see the field name in the interesting fields. 

 

Please suggest in this. 

 

Thanks

Sagar

 

 

 

Labels (3)
0 Karma

ashvinpandey
Contributor

@sagar_shubham Try using the below rex:

| rex field=_raw "login_id\"\:\"(?P<login_id>.*?)\""

Also if this reply helped you in solving your problem an up-vote would be appreciated 👍

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That regex has a few extra characters in it (and some missing ones) that prevent a match.  Also, "\w+" won't match the full login_id field because of the "@" (which is not a word character).  Finally, embedded quotation marks need to be escaped.  Try this command:

| rex field=User_Claim "login_id\\\":\\\" \\\"(?<loginID>[^\\\"]+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

sagar_shubham
Explorer

This is not working Sir. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Meaning what, exactly?  Please share the full query you tried, what results were expected, and what results you got.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...