regex works on regex101 but not splunk

[samneo]

Im trying to get a regex to work in splunk that works in regex101

Im using the below regex

\b(a_msg)\b[^"]+"([^"]*)"

this will extract everything after a_msg field and in between the "". I want to save this as a field extraction. Any idea how i can get this to work?

example data

{"log":"a_level=\"INFO\", a_time=\"2021-09-17 07:33:35,210\",  a_msg=\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\","level":"info"}

[kamlesh_vaghela]

@samneo 

Can you please share your sample data and configurations you are using?

KV

[samneo]

@kamlesh_vaghela Added to original post. There is no special configuration, i just want to be able to add it into field extraction via ui. We have splunk managed cloud so cannot amend from props.conf or any other backend

[kamlesh_vaghela · Accepted solution]

@samneo 

Can you please try this?

\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\"

My Sample Code:

| makeresults | eval _raw="{\"log\":\"a_level=\\\"INFO\\\", a_time=\\\"2021-09-17 07:33:35,210\\\",  a_msg=\\\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\\\",\"level\":\"info\"}" |rex field=_raw "\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\""

Link:

https://regex101.com/r/ZDYHZM/1

Thanks
KV
▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[samneo]

this works perfectly,

thanks @kamlesh_vaghela