Splunk Search

rex a string from text

dacamargov
Engager

How do I extract the cities from this text? 

\"timezone\"😕"America/Sao_Paulo\",\"max_counter\":2,\"timezone\":\"America/Brasilia\",\"max_counter\":2...

I tried to compute the following query: ... | rex field=city "city: (?<America>)" | top limit=20 city

Thanks! 

 

Labels (1)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

  this works in regex101

| rex "timezone\\(.*?)\/(?<city>[^\\]+)"

 

 - working in Splunk

| rex "timezone\\\(.*?)\/(?<city>[^\\\]+)"

 

upvote if this works

————————————
If this helps, give a like below.

View solution in original post

0 Karma

to4kawa
Ultra Champion

If your log is JSON, please _raw text. not your modified samples.

0 Karma

dacamargov
Engager

hey guys, here the real sample: 

{\"dialog_node\"😕"node_1_1512565351738\",\"title\"😕"TAG_TEL_2.1.01_xingamentos - Ofensas - Nós de transferência\",\"conditions\"😕"intents[0].confidence > 0.7\"}],\"log_messages\":[]},\"context\":{\"CONTENT_OMITTEDa\":{\"CONTENT_OMITTEDt\"😕"NextChatV1\"},\"conversation_id\"😕"d4d7e1fa-7ecc-4eed-b496-f6a24d0c52fa\",\"system\":{\"initialized\":true,\"dialog_stack\":[{\"dialog_node\"😕"node_1_1512565351738\"}],\"dialog_turn_counter\":18,\"dialog_request_counter\":18,\"_node_output_map\":{\"Welcome\":[0],\"node_4_1545219778942\":[0,0],\"node_6_1506019673483\":[0],\"node_10_1586976201933\":{\"0\":[0]},\"response_89_1586976254180\":{\"0\":[0]},\"node_85_1586976254180\":{\"0\":[0]},\"node_1_1507049882219\":[0],\"response_202_1586977011758\":[0],\"response_192_1586977011758\":{\"0\":[0]},\"response_186_1586977011758\":{\"0\":[0]},\"node_182_1586977011758\":{\"0\":[0]},\"node_1_1560349134258\":[0],\"node_1_1516808150030\":[0,2,1,0],\"node_1_1512565351738\":[0]},\"branch_exited\":true,\"branch_exited_reason\"😕"fallback\"},\"algar\":true,\"counter\":1,\"holidays\"😕"[\\\"11/06/20\\\"]\",\"timezone\"😕"America/Sao_Paulo\",\"max_counter\":2,\"lastTopicname\"😕"\",\"threshold_counter\":1,\"transfer_agent_counter\":1,\"teste_oferta_credito_inicio\":false,\"jornada_strut\"😕"next0_geral_-_-_ofensas\"}}","headers":"{content-length=[2036], content-type=[application/json;charset=UTF-8], date=[Mon03 Aug 2020 13:48:38 GMT], server=[Apache-Coyote/1.1], x-server_address=[::ffff:10.215.42.116]}","params":null,"status":200,"processingTime":531}

it is one of many, each one is a log containing that info... I am interested in extract the geolocation of them...

Thanks for the help! 

Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

  this works in regex101

| rex "timezone\\(.*?)\/(?<city>[^\\]+)"

 

 - working in Splunk

| rex "timezone\\\(.*?)\/(?<city>[^\\\]+)"

 

upvote if this works

————————————
If this helps, give a like below.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should work

| rex max_match=0 "\/(?<city>\w+)"
| mvexpand city
---
If this reply helps you, Karma would be appreciated.
0 Karma

dacamargov
Engager

Did not work, I want to create an extra coulum "city" from the sample text containig: Sao_Paulo and Brasilia

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It works on my test system.

| makeresults | eval _raw="\"timezone\":\"America/Sao_Paulo\",\"max_counter\":2,\"timezone\":\"America/Brasilia\",\"max_counter\":2..."
| rex max_match=0 "\/(?<city>\w+)"
| mvexpand city
| top limit=20 city

richgalloway_0-1596481653551.png

 

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

dacamargov
Engager

How it will be writen using the "America" string before? I really need to use it as I put in the example, sorry for dont say that before. 

ps: It is beacuse the real text is huge and then matching with /\ will not works, have to be with the "America" word before it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I didn't assume all of the cities are in the Americas when I made the example.  To fix it, just put "America" in the regular expression.

| makeresults | eval _raw="\"timezone\":\"America/Sao_Paulo\",\"max_counter\":2,\"timezone\":\"America/Brasilia\",\"max_counter\":2..."
| rex max_match=0 "America\/(?<city>\w+)"
| mvexpand city
| top limit=20 city
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...