Splunk Search

regex works on regex101 but not splunk

samneo
Path Finder

Im trying to get a regex to work in splunk that works in regex101

Im using the below regex

\b(a_msg)\b[^"]+"([^"]*)"

this will extract everything after a_msg field and in between the "". I want to save this as a field extraction. Any idea how i can get this to work?

example data

{"log":"a_level=\"INFO\", a_time=\"2021-09-17 07:33:35,210\",  a_msg=\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\","level":"info"}

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samneo 

Can you please try this?

\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\"

 

My Sample Code:

| makeresults | eval _raw="{\"log\":\"a_level=\\\"INFO\\\", a_time=\\\"2021-09-17 07:33:35,210\\\",  a_msg=\\\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\\\",\"level\":\"info\"}" |rex field=_raw "\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\""

 

Link:

https://regex101.com/r/ZDYHZM/1

Thanks
KV
▄︻̷̿┻̿═━一   :winking_face:

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samneo 

Can you please share your sample data and configurations you are using?

KV

0 Karma

samneo
Path Finder

@kamlesh_vaghela Added to original post. There is no special configuration, i just want to be able to add it into field extraction via ui. We have splunk managed cloud so cannot amend from props.conf or any other backend

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samneo 

Can you please try this?

\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\"

 

My Sample Code:

| makeresults | eval _raw="{\"log\":\"a_level=\\\"INFO\\\", a_time=\\\"2021-09-17 07:33:35,210\\\",  a_msg=\\\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\\\",\"level\":\"info\"}" |rex field=_raw "\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\""

 

Link:

https://regex101.com/r/ZDYHZM/1

Thanks
KV
▄︻̷̿┻̿═━一   :winking_face:

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

samneo
Path Finder

this works perfectly,

thanks @kamlesh_vaghela 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...