Hello Splunkers,
Please advise how to use regex to extract the below specific fields from _raw data and also add/rename the field name.The Index is a summary Index
Sample Raw Data:
"cutom_id":"nuyc0989","group_na":"vc_iod","kit_num":"tach-98"
"cutom_id":"nuyc0989","group_na":"no_eng","kit_num":"vch-76"
"cutom_id":"nuyc0989","group_na":"vc_hk","kit_num":"tach-k89"
I only want to extract {field:value} of "group_na" (rename field to assigned_to) & "kit_num" (rename field to Tax_ID) in the search results for all the _raw data of the summary index.
Below search query is not extracting the required field from the raw data ,please advise
Search Query -
index=<summary_index> | rex field=_raw "\"group_na\": (?<assgined_to>*)"
Your rex expression is wrong and "assgined_to" is spelt incorrectly. You can do it either with rex as in your original example
| makeresults
| eval _raw="\"cutom_id\":\"nuyc0989\",\"group_na\":\"vc_iod\",\"kit_num\":\"tach-98\";\"cutom_id\":\"nuyc0989\",\"group_na\":\"no_eng\",\"kit_num\":\"vch-76\";\"cutom_id\":\"nuyc0989\",\"group_na\":\"vc_hk\",\"kit_num\":\"tach-k89\""
| eval data=split(_raw,";")
| mvexpand data
| fields data
| rename data as _raw
| rex field=_raw "\"group_na\":\"(?<assigned_to>[^\"]*)"
| table assigned_to
or using extract like this
| makeresults
| eval _raw="\"cutom_id\":\"nuyc0989\",\"group_na\":\"vc_iod\",\"kit_num\":\"tach-98\";\"cutom_id\":\"nuyc0989\",\"group_na\":\"no_eng\",\"kit_num\":\"vch-76\";\"cutom_id\":\"nuyc0989\",\"group_na\":\"vc_hk\",\"kit_num\":\"tach-k89\""
| eval data=split(_raw,";")
| mvexpand data
| fields data
| rename data as _raw
| extract pairdelim="," kvdelim=":"
| rename group_na as assigned_to
| fields assigned_to
extract will work on raw and take key/value pairs from your data
Thank you @bowesmana , how can i extract multiple fields , is the below syntax correct for extracting multiple fields , its not giving me any o/p.
| rex field=_raw "\"group_na\":\"(?<assigned_to>[^\"]*) \cutom_id\":\"(?<cust_id>[^\"]*)" | table assigned_to,cust_id
for extract pairdelim="," kvdelim=":" , i am having trouble extracting the data from _raw for below specific formats , for the rest it works fine , any clue how we can we fix this ?
"j_yul_flt.name":"3-4tux","b_ccl_flt.guv":"7-6bno","j_nyc_flt.name":"3-4iot","b_chp_flt.guv":"7-6ews"
This appears to work.
| makeresults
| eval _raw="\"j_yul_flt.name\":\"3-4tux\",\"b_ccl_flt.guv\":\"7-6bno\",\"j_nyc_flt.name\":\"3-4iot\",\"b_chp_flt.guv\":\"7-6ews\""
| extract pairdelim="," kvdelim=":"
extract always works on the _raw field