Splunk Search

regex

simo
Path Finder

Hi all,

I have a column containing
Request = REQ_IN ...... { ...... "productId": "test", ...... { ....... "productId": "test2" }}
I have to take the containing value in the first one productId test
I using = | rex field=Request "REQ_IN.*\"productId\"(?<productId_rex>[^,]*)"
but it returns me the second value test2
how can i solve?

Simone

Labels (1)
0 Karma

manjunathmeti
Champion

hi @simo,
Command rex captures the first match in the group. Try this:

| makeresults 
| eval test="Request = REQ_IN ...... { ...... \"productId\": \"test\", ...... { ....... \"productId\": \"test2\" }}" 
| rex field=test "\"productId\":\s*\"(?<productId_rex>[^\"]+)\""
0 Karma

simo
Path Finder

Hi @manjunathmeti 

so he is taking the first one, at the beginning I need him to take REQ_IN and so something doesn't work 😞

| makeresults
| eval test="REQ_IN ...... { ...... \"productId\": \"test\", ...... { ....... \"productId\": \"test2\" }}"
| rex field=test "REQ_IN.*\"productId\":\s*\"(?<productId_rex>[^\"]+)\""

Simone

0 Karma

manjunathmeti
Champion

You need to use lazy quantifier (*?B instead of greedy (*) to match as few characters as possible. Try this.

| makeresults
| eval test="REQ_IN ...... { ...... \"productId\": \"test\", ...... { ....... \"productId\": \"test2\" }}"
| rex field=test "REQ_IN.*?\"productId\":\s*\"(?<productId_rex>[^\"]+)\""

 

If this reply helps you, a like would be appreciated.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

@manjunathmeti Looks very similar to my answer from yesterday 🙂

0 Karma

manjunathmeti
Champion

Yes, it is. My bad I was like lazy quantifier 😀

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to use lazy expansion on the any character, something like:

| rex field=Request "REQ_IN.+?\"productId\":\s(?<productId_rex>[^,]*)"

 

0 Karma

simo
Path Finder

hi @ITWhisperer 

thanks so it goes, but it does not work if the value of productId is only once 😞

simone

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I was following your example, but perhaps you could also not extract the quotation marks and use that as the delimiter, rather than the comma, as I suspect that isn't present if there is only one?

| rex field=Request "REQ_IN.+?\"productId\":\s\"(?<productId_rex>[^\"]*)"
0 Karma

aasabatini
Motivator

Hi @simo 

 

Can you try this regex?

^(?:[^:\n]*:){1}\"(?<productid>\w+)
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

simo
Path Finder

it's not working 😞

0 Karma

aasabatini
Motivator

@simo  don't  worry

try this

^[^:\n]*:\"(?P<productId>\w+)
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...