Splunk Search

regex

simo
Explorer

Hi all,

I have a column containing
Request = REQ_IN ...... { ...... "productId": "test", ...... { ....... "productId": "test2" }}
I have to take the containing value in the first one productId test
I using = | rex field=Request "REQ_IN.*\"productId\"(?<productId_rex>[^,]*)"
but it returns me the second value test2
how can i solve?

Simone

Labels (1)
0 Karma

manjunathmeti
Champion

hi @simo,
Command rex captures the first match in the group. Try this:

| makeresults 
| eval test="Request = REQ_IN ...... { ...... \"productId\": \"test\", ...... { ....... \"productId\": \"test2\" }}" 
| rex field=test "\"productId\":\s*\"(?<productId_rex>[^\"]+)\""
0 Karma

simo
Explorer

Hi @manjunathmeti 

so he is taking the first one, at the beginning I need him to take REQ_IN and so something doesn't work 😞

| makeresults
| eval test="REQ_IN ...... { ...... \"productId\": \"test\", ...... { ....... \"productId\": \"test2\" }}"
| rex field=test "REQ_IN.*\"productId\":\s*\"(?<productId_rex>[^\"]+)\""

Simone

0 Karma

manjunathmeti
Champion

You need to use lazy quantifier (*?B instead of greedy (*) to match as few characters as possible. Try this.

| makeresults
| eval test="REQ_IN ...... { ...... \"productId\": \"test\", ...... { ....... \"productId\": \"test2\" }}"
| rex field=test "REQ_IN.*?\"productId\":\s*\"(?<productId_rex>[^\"]+)\""

 

If this reply helps you, a like would be appreciated.

0 Karma

ITWhisperer
Legend

@manjunathmeti Looks very similar to my answer from yesterday 🙂

0 Karma

manjunathmeti
Champion

Yes, it is. My bad I was like lazy quantifier 😀

0 Karma

ITWhisperer
Legend

You need to use lazy expansion on the any character, something like:

| rex field=Request "REQ_IN.+?\"productId\":\s(?<productId_rex>[^,]*)"

 

0 Karma

simo
Explorer

hi @ITWhisperer 

thanks so it goes, but it does not work if the value of productId is only once 😞

simone

0 Karma

ITWhisperer
Legend

I was following your example, but perhaps you could also not extract the quotation marks and use that as the delimiter, rather than the comma, as I suspect that isn't present if there is only one?

| rex field=Request "REQ_IN.+?\"productId\":\s\"(?<productId_rex>[^\"]*)"
0 Karma

aasabatini
Builder

Hi @simo 

 

Can you try this regex?

^(?:[^:\n]*:){1}\"(?<productid>\w+)
0 Karma

simo
Explorer

it's not working 😞

0 Karma

aasabatini
Builder

@simo  don't  worry

try this

^[^:\n]*:\"(?P<productId>\w+)
0 Karma