Splunk Search

rex a string from text

dacamargov
Engager

How do I extract the cities from this text? 

\"timezone\"😕"America/Sao_Paulo\",\"max_counter\":2,\"timezone\":\"America/Brasilia\",\"max_counter\":2...

I tried to compute the following query: ... | rex field=city "city: (?<America>)" | top limit=20 city

Thanks! 

 

Labels (1)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

  this works in regex101

| rex "timezone\\(.*?)\/(?<city>[^\\]+)"

 

 - working in Splunk

| rex "timezone\\\(.*?)\/(?<city>[^\\\]+)"

 

upvote if this works

————————————
If this helps, give a like below.

View solution in original post

0 Karma

to4kawa
Ultra Champion

If your log is JSON, please _raw text. not your modified samples.

0 Karma

dacamargov
Engager

hey guys, here the real sample: 

{\"dialog_node\"😕"node_1_1512565351738\",\"title\"😕"TAG_TEL_2.1.01_xingamentos - Ofensas - Nós de transferência\",\"conditions\"😕"intents[0].confidence > 0.7\"}],\"log_messages\":[]},\"context\":{\"CONTENT_OMITTEDa\":{\"CONTENT_OMITTEDt\"😕"NextChatV1\"},\"conversation_id\"😕"d4d7e1fa-7ecc-4eed-b496-f6a24d0c52fa\",\"system\":{\"initialized\":true,\"dialog_stack\":[{\"dialog_node\"😕"node_1_1512565351738\"}],\"dialog_turn_counter\":18,\"dialog_request_counter\":18,\"_node_output_map\":{\"Welcome\":[0],\"node_4_1545219778942\":[0,0],\"node_6_1506019673483\":[0],\"node_10_1586976201933\":{\"0\":[0]},\"response_89_1586976254180\":{\"0\":[0]},\"node_85_1586976254180\":{\"0\":[0]},\"node_1_1507049882219\":[0],\"response_202_1586977011758\":[0],\"response_192_1586977011758\":{\"0\":[0]},\"response_186_1586977011758\":{\"0\":[0]},\"node_182_1586977011758\":{\"0\":[0]},\"node_1_1560349134258\":[0],\"node_1_1516808150030\":[0,2,1,0],\"node_1_1512565351738\":[0]},\"branch_exited\":true,\"branch_exited_reason\"😕"fallback\"},\"algar\":true,\"counter\":1,\"holidays\"😕"[\\\"11/06/20\\\"]\",\"timezone\"😕"America/Sao_Paulo\",\"max_counter\":2,\"lastTopicname\"😕"\",\"threshold_counter\":1,\"transfer_agent_counter\":1,\"teste_oferta_credito_inicio\":false,\"jornada_strut\"😕"next0_geral_-_-_ofensas\"}}","headers":"{content-length=[2036], content-type=[application/json;charset=UTF-8], date=[Mon03 Aug 2020 13:48:38 GMT], server=[Apache-Coyote/1.1], x-server_address=[::ffff:10.215.42.116]}","params":null,"status":200,"processingTime":531}

it is one of many, each one is a log containing that info... I am interested in extract the geolocation of them...

Thanks for the help! 

Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

  this works in regex101

| rex "timezone\\(.*?)\/(?<city>[^\\]+)"

 

 - working in Splunk

| rex "timezone\\\(.*?)\/(?<city>[^\\\]+)"

 

upvote if this works

————————————
If this helps, give a like below.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should work

| rex max_match=0 "\/(?<city>\w+)"
| mvexpand city
---
If this reply helps you, Karma would be appreciated.
0 Karma

dacamargov
Engager

Did not work, I want to create an extra coulum "city" from the sample text containig: Sao_Paulo and Brasilia

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It works on my test system.

| makeresults | eval _raw="\"timezone\":\"America/Sao_Paulo\",\"max_counter\":2,\"timezone\":\"America/Brasilia\",\"max_counter\":2..."
| rex max_match=0 "\/(?<city>\w+)"
| mvexpand city
| top limit=20 city

richgalloway_0-1596481653551.png

 

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

dacamargov
Engager

How it will be writen using the "America" string before? I really need to use it as I put in the example, sorry for dont say that before. 

ps: It is beacuse the real text is huge and then matching with /\ will not works, have to be with the "America" word before it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I didn't assume all of the cities are in the Americas when I made the example.  To fix it, just put "America" in the regular expression.

| makeresults | eval _raw="\"timezone\":\"America/Sao_Paulo\",\"max_counter\":2,\"timezone\":\"America/Brasilia\",\"max_counter\":2..."
| rex max_match=0 "America\/(?<city>\w+)"
| mvexpand city
| top limit=20 city
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...