how to match value in events using Rex

[james_n]

Hi experts,

please help me with regular expression to match the value in each event at search time as shown below

:{\"buaid\":{\"business\":[\"12345\"],\"exclude*

required output: bss_value=12345

thanks in advance.

[to4kawa]

|rex "(?<bss_value>\d{5})"

This is enough.

[jpolvino]

This might get you close, with a run anywhere example:

| makeresults | eval _raw=":{\\\"buaid\\\":{\\\"business\\\":[\\\"12345\\\"],\\\"exclude*"
| rex ":{\\\\\"buaid\\\\\":{\\\\\"business\\\\\":\[\\\\\"(?<bss_value>[^\\\]+)\\\\\"\],"

It sets up a _raw field, and then extracts from it. The last line should do it for you.

[james_n]

Hi @jpolvino , thanks for the answer. its working fine. but if i have multiple values with , separated than its not working .Please help on this.

Ex: :{\"buaid\":{\"business\":[\"12345\",\"6789\"]

[richgalloway]

Try

business\\":\[\\"(?<bss_value>[^\\]+)\\