Splunk Search

regex works on regex101 but not splunk

samneo
Path Finder

Im trying to get a regex to work in splunk that works in regex101

Im using the below regex

\b(a_msg)\b[^"]+"([^"]*)"

this will extract everything after a_msg field and in between the "". I want to save this as a field extraction. Any idea how i can get this to work?

example data

{"log":"a_level=\"INFO\", a_time=\"2021-09-17 07:33:35,210\",  a_msg=\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\","level":"info"}

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samneo 

Can you please try this?

\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\"

 

My Sample Code:

| makeresults | eval _raw="{\"log\":\"a_level=\\\"INFO\\\", a_time=\\\"2021-09-17 07:33:35,210\\\",  a_msg=\\\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\\\",\"level\":\"info\"}" |rex field=_raw "\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\""

 

Link:

https://regex101.com/r/ZDYHZM/1

Thanks
KV
▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samneo 

Can you please share your sample data and configurations you are using?

KV

0 Karma

samneo
Path Finder

@kamlesh_vaghela Added to original post. There is no special configuration, i just want to be able to add it into field extraction via ui. We have splunk managed cloud so cannot amend from props.conf or any other backend

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@samneo 

Can you please try this?

\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\"

 

My Sample Code:

| makeresults | eval _raw="{\"log\":\"a_level=\\\"INFO\\\", a_time=\\\"2021-09-17 07:33:35,210\\\",  a_msg=\\\"CommissionRouteType: Client / clientId: 111/ planId: 111 / PolicyBusinessId: 111\\\",\"level\":\"info\"}" |rex field=_raw "\b(a_msg)\b[^\"]+\"(?<a_msg>[^\"]*)\""

 

Link:

https://regex101.com/r/ZDYHZM/1

Thanks
KV
▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

samneo
Path Finder

this works perfectly,

thanks @kamlesh_vaghela 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...