Splunk Search

extract string between backward slash and quote

pinalshah341
Loves-to-Learn

{\"reference_id\":\"REF1\",\"sub_reference_id\":\"sub_ref_1\"}

required output : table of reference_id, sub_reference_id

For the above search string : 

I am trying  :

rex field=_raw "reference_id\\\\":\\\\"(?P<reference_id>.P[^\"]*)"

But it is not working. can someone help with the correct rex command to extract the fields explicitely

Labels (3)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="{\\\"reference_id\\\":\\\"REF1\\\",\\\"sub_reference_id\\\":\\\"sub_ref_1\\\"}"
| rename COMMENT as "this is sample"
| rex mode=sed "s/\\\//g"
| spath

try rex with sed mode and spath.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

First two lines set up your example data - main line extracts the two values into the fields

| makeresults 
| eval _raw="{\\\"reference_id\\\":\\\"REF1\\\",\\\"sub_reference_id\\\":\\\"sub_ref_1\\\"}"


| rex field=_raw "reference_id\\\\\":\\\\\"(?P<reference_id>[^\\\\\"]*)\\\\\",\\\\\"sub_reference_id\\\\\":\\\\\"(?P<sub_reference_id>[^\\\\\"]*)"
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@pinalshah341 

| makeresults 
| eval _raw="{\\\"reference_id\\\":\\\"REF1\\\",\\\"sub_reference_id\\\":\\\"sub_ref_1\\\"}"
| rex field=_raw "reference_id\\\\\":\\\\\"(?P<reference_id>[^\\\\\"]*)"
0 Karma

pinalshah341
Loves-to-Learn

The value is not a constant string. Hence, need a query that fetches the value dynamically.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@pinalshah341 

That rex statement is exactly that - extracting the dynamic reference - the REF1 is your example data showing how it works

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...