Splunk Search

regex field extraction - match field in double quotes after sting match

rotundwizard
Explorer

I'm attempting to build a regex that will extract a field enclosed in double-quotes, after a string match. Basically I want to extract a field 4 fields after the string POST. All fields enclosed in double-quotes, separated by commas.

"*several fields*","POST","field1","field2","field3","field4","**THE_FIELD_I_NEED**"

Any assistance would be welcome!

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @rotundwizard

Give this a try: \"POST\",[^\,]+,[^\,]+,[^\,]+,[^\,]+,\"(?<my_new_field>[^\,]+)\"

https://regex101.com/r/ObxLtM/1

All the best

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "\"POST\",(?:[^\,]+,){4}\"(?<the_field_I_need>[^\,]+)\""
0 Karma

saurabhkharkar
Path Finder
Try this

|rex field=_raw "POST\"\,\"\w+\"\,\"\w+\"\,\"\w+\"\,\"\w+\"\,\"(?<optuput>\w+)\""
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Be aware this this one won't work correctly if one of you fields has spaces in it.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @rotundwizard

Give this a try: \"POST\",[^\,]+,[^\,]+,[^\,]+,[^\,]+,\"(?<my_new_field>[^\,]+)\"

https://regex101.com/r/ObxLtM/1

All the best

0 Karma

rotundwizard
Explorer

This technically did work, for my specific situation it did not (my fault for not providing sufficient detail). One of the fields after the POST string contains a comma. Which would be fine, except that comma isn't always there depending on the log data. Would it be possible to key in on the double-quotes, instead of the commas?

"several fields","POST","field1" "field2","field3","field4","thefieldIwant"

OR

"several fields","POST","field1" "field2","field3","field,4","thefieldIwant"

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Try this one:

https://regex101.com/r/ObxLtM/2

\"POST\",(?:\"[^\"]+\",){4}\"(?<my_new_field>[^\,]+)\"

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

or this \"POST\",(?:\"[^\"]+\",){4}\"(?<my_new_field>[^\"]+)\"

https://regex101.com/r/ObxLtM/3

0 Karma

rotundwizard
Explorer

Both work perfectly, thank you very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...