Splunk Search

regex field extraction - match field in double quotes after sting match

rotundwizard
Explorer

I'm attempting to build a regex that will extract a field enclosed in double-quotes, after a string match. Basically I want to extract a field 4 fields after the string POST. All fields enclosed in double-quotes, separated by commas.

"*several fields*","POST","field1","field2","field3","field4","**THE_FIELD_I_NEED**"

Any assistance would be welcome!

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @rotundwizard

Give this a try: \"POST\",[^\,]+,[^\,]+,[^\,]+,[^\,]+,\"(?<my_new_field>[^\,]+)\"

https://regex101.com/r/ObxLtM/1

All the best

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "\"POST\",(?:[^\,]+,){4}\"(?<the_field_I_need>[^\,]+)\""
0 Karma

saurabhkharkar
Path Finder
Try this

|rex field=_raw "POST\"\,\"\w+\"\,\"\w+\"\,\"\w+\"\,\"\w+\"\,\"(?<optuput>\w+)\""
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Be aware this this one won't work correctly if one of you fields has spaces in it.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @rotundwizard

Give this a try: \"POST\",[^\,]+,[^\,]+,[^\,]+,[^\,]+,\"(?<my_new_field>[^\,]+)\"

https://regex101.com/r/ObxLtM/1

All the best

0 Karma

rotundwizard
Explorer

This technically did work, for my specific situation it did not (my fault for not providing sufficient detail). One of the fields after the POST string contains a comma. Which would be fine, except that comma isn't always there depending on the log data. Would it be possible to key in on the double-quotes, instead of the commas?

"several fields","POST","field1" "field2","field3","field4","thefieldIwant"

OR

"several fields","POST","field1" "field2","field3","field,4","thefieldIwant"

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Try this one:

https://regex101.com/r/ObxLtM/2

\"POST\",(?:\"[^\"]+\",){4}\"(?<my_new_field>[^\,]+)\"

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

or this \"POST\",(?:\"[^\"]+\",){4}\"(?<my_new_field>[^\"]+)\"

https://regex101.com/r/ObxLtM/3

0 Karma

rotundwizard
Explorer

Both work perfectly, thank you very much!

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...