Splunk Search

Using regex to extract summary

bigll
Path Finder

in raw data I have portion that I would like to use in report.

"changes":{"description":{"before":"<some text or empty>","after":"<some text or empty>"}}

 

I created 

rex summary= "changes":\{"description":\{"before":"<some text or empty>","after":"<some text or empty>"\}\})"

But it doesn't work.

Please advise

Labels (1)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bigll ,

as @ITWhisperer said, this seems to be a json format so the INDEXED_ENTRACTION = json option in props.conf or the spath command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Spath) is the easiest solution to your requirement.

Then the rex command has a different format to extract fields: the fied definition must be located inside the rex definition, as the following example using your data:

| rex "before\":\"(?<summary_before>[^\"]+)\".\"after\":\"(?<summary_after>[^\"]+)"

You can see how to extract and test your regex at https://regex101.com/r/22aHz1/1

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is not how rex works - you need to provide a pattern as a regular expression to identify what you want to extract. For example, do you want everything from "change" to "}}"? Does this pattern hold true for all your event where you want to extract this field?

Aside from that, this looks like json - why aren't you using spath or the other json functions to extract the json field?

0 Karma

bigll
Path Finder

Thank you for your message.

You are correct, I need everything between {} as a value of the field I can include in the table.


0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| rex "\"changes\":(?<changes>\{.*?\}\})"
0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...