Splunk Search

regex field extraction - match field in double quotes after sting match

rotundwizard
Explorer

I'm attempting to build a regex that will extract a field enclosed in double-quotes, after a string match. Basically I want to extract a field 4 fields after the string POST. All fields enclosed in double-quotes, separated by commas.

"*several fields*","POST","field1","field2","field3","field4","**THE_FIELD_I_NEED**"

Any assistance would be welcome!

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @rotundwizard

Give this a try: \"POST\",[^\,]+,[^\,]+,[^\,]+,[^\,]+,\"(?<my_new_field>[^\,]+)\"

https://regex101.com/r/ObxLtM/1

All the best

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "\"POST\",(?:[^\,]+,){4}\"(?<the_field_I_need>[^\,]+)\""
0 Karma

saurabhkharkar
Path Finder
Try this

|rex field=_raw "POST\"\,\"\w+\"\,\"\w+\"\,\"\w+\"\,\"\w+\"\,\"(?<optuput>\w+)\""
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Be aware this this one won't work correctly if one of you fields has spaces in it.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @rotundwizard

Give this a try: \"POST\",[^\,]+,[^\,]+,[^\,]+,[^\,]+,\"(?<my_new_field>[^\,]+)\"

https://regex101.com/r/ObxLtM/1

All the best

0 Karma

rotundwizard
Explorer

This technically did work, for my specific situation it did not (my fault for not providing sufficient detail). One of the fields after the POST string contains a comma. Which would be fine, except that comma isn't always there depending on the log data. Would it be possible to key in on the double-quotes, instead of the commas?

"several fields","POST","field1" "field2","field3","field4","thefieldIwant"

OR

"several fields","POST","field1" "field2","field3","field,4","thefieldIwant"

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Try this one:

https://regex101.com/r/ObxLtM/2

\"POST\",(?:\"[^\"]+\",){4}\"(?<my_new_field>[^\,]+)\"

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

or this \"POST\",(?:\"[^\"]+\",){4}\"(?<my_new_field>[^\"]+)\"

https://regex101.com/r/ObxLtM/3

0 Karma

rotundwizard
Explorer

Both work perfectly, thank you very much!

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...