Splunk Search

extraction help

valpravin
Engager

Hi Team

can you please help in extracting the  123456 from following string

hello world  \"employee\":123456

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Depending on whether your escaped quotes are in your data or not...  This example includes the \ as part of the raw data string

| makeresults
| eval _raw="hello world  \\\"employee\\\":123456"
| rex field=_raw "hello world  \\\\\"employee\\\\\":(?<id>\d+)"

 So, the 5 \ characters in rex will recognise the single \ in your data

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...