Splunk Search

regex works on regex101 but not splunk

samneo
Path Finder

Im trying to get a regex to work in splunk that works in regex101

Im using the below regex

\b(a_msg)\b[^"]+"([^"]*)"

this will extract everything after a_msg field and in between the "". I want to save this as a field extraction. Any idea how i can get this to work?

example data

{"log":"a_level=\"INFO\", a_time=\"2021-09-17 07:33:35,210\",  a_msg=\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\","level":"info"}

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samneo 

Can you please try this?

\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\"

 

My Sample Code:

| makeresults | eval _raw="{\"log\":\"a_level=\\\"INFO\\\", a_time=\\\"2021-09-17 07:33:35,210\\\",  a_msg=\\\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\\\",\"level\":\"info\"}" |rex field=_raw "\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\""

 

Link:

https://regex101.com/r/ZDYHZM/1

Thanks
KV
▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samneo 

Can you please share your sample data and configurations you are using?

KV

0 Karma

samneo
Path Finder

@kamlesh_vaghela Added to original post. There is no special configuration, i just want to be able to add it into field extraction via ui. We have splunk managed cloud so cannot amend from props.conf or any other backend

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samneo 

Can you please try this?

\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\"

 

My Sample Code:

| makeresults | eval _raw="{\"log\":\"a_level=\\\"INFO\\\", a_time=\\\"2021-09-17 07:33:35,210\\\",  a_msg=\\\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\\\",\"level\":\"info\"}" |rex field=_raw "\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\""

 

Link:

https://regex101.com/r/ZDYHZM/1

Thanks
KV
▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

samneo
Path Finder

this works perfectly,

thanks @kamlesh_vaghela 

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...