Splunk Search

Unable to create field using regex

sagar_shubham
Explorer

Hi Team, 

 

Need your help in creating regex to create a field. 

"User_Claim":("sub":"qweihaytej"; "login_id":"Abc@domain.com";........) 

Here User_Claim is a field. I have to create a field for login_id.

I have tried with this, and it's not working. 

..... | rex field=User_Claim " login_id"(? <loginID>\w+.) "

I am unable to see the field name in the interesting fields. 

 

Please suggest in this. 

 

Thanks

Sagar

 

 

 

Labels (3)
0 Karma

ashvinpandey
Contributor

@sagar_shubham Try using the below rex:

| rex field=_raw "login_id\"\:\"(?P<login_id>.*?)\""

Also if this reply helped you in solving your problem an up-vote would be appreciated 👍

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That regex has a few extra characters in it (and some missing ones) that prevent a match.  Also, "\w+" won't match the full login_id field because of the "@" (which is not a word character).  Finally, embedded quotation marks need to be escaped.  Try this command:

| rex field=User_Claim "login_id\\\":\\\" \\\"(?<loginID>[^\\\"]+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

sagar_shubham
Explorer

This is not working Sir. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Meaning what, exactly?  Please share the full query you tried, what results were expected, and what results you got.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...