extract custom filed and display value in the table output

[narenpg]

Query
index=java networkenv=prod stackenv=prod source="/opt/jboss/standalone/custom_engine.log"
|convert ctime(_time) as time timeformat="%m/%d/%Y %H:%M:%S"
|rex field=_raw ""orderEnteredBy":\"(?[^\"]+\")"
|table time orderEnteredBy

It matches the word orderEnteredBy but when i tried to get the name into the table it shows empty..

Here is the log
availableBalance":{},"projectedBalance":{}}},"productSummary":{"symbol":"RPACX","displayValue":"RPACX","cusip":"32254T759","assetType":"MUTUAL_FUND","description":"UFACRESCENT FUND N/L","settlementDuration":4,"omnibusProduct":true},"orderEnteredBy":"JANEDOE","orderUpdatedBy":"SYS_USER","dirtyFSTT":false,"messagesSummary":{"messagesCount":2,"errorsCount":0,"warningsCount":0,"infosCount":0},"assetType":"MUTUAL_FUND","fundServTransactionTypeDetails":{"cdscValueOverridable":false,"netAssetValue":"NAV_OTHER","rightsOfAccumulation":{"additionalHoldings":0,"manualOverride":false,"additionalHoldingsValid":true}

[narenpg]

Oops Sorry it is working... There was a typo.. Thanks a lot

[gcusello · Accepted solution]

Hi @narenpg,
to display code use the Code sample button (the one with 101010)
Anyway the correct search should be:

index=java networkenv=prod stackenv=prod source="/opt/jboss/standalone/custom_engine.log"
| convert ctime(_time) as time timeformat="%m/%d/%Y %H:%M:%S"
| rex "\"orderEnteredBy\":\"(?<orderEnteredBy>[^\"]*)\""
| table time orderEnteredBy

You can test the regex at https://regex101.com/r/5D8hAf/1

Ciao.
Giuseppe

[narenpg]

I did use the regex101 for this.. After using your regex, i am still not seeing the output for the table orderEnteredBy. Do i have to use makeresults

[gcusello]

Hi @narenpg,
no makeresuts generates the specified number of search results, you have to use your search,
did you're using a Fast Mode or a Verbose Mode?
If Fast, try Verbose.

Ciao.
Giuseppe

[narenpg]

Somehow the name value is missed from my post
|rex field=_raw ""orderEnteredBy":\"(?[^\"]+\")"