rex expression does not works as expected

[karthi25]

I have a following splunk log

2018-03-13T06:28:23.543266+00:00 Commissions.development.loan*** 103a9[[APP/PROC/WEB/0]]: cf_foundation=px-*** cf_app_name=loan*** cf_app_id=**** cf_org_name=Commissions cf_org_id=***** cf_space_name=development cf_space_id=70344c05-60c9-437b-ab88-432a33101022 .source.s_cf_apps {"@timestamp":"2018-03-12T23:28:23.542-07:00","@version":1,"message":"class CreateLoanRequestPayload {\n    createLoanRequest: class CreateLoanRequest {\n        header: class Header {\n            senderid: Test123\n            channelid: channel123\n            applicationid: NFS\n            applicationuserid: user123\n            sessionid: session123\n            interactionid: intc123\n            activityid: actv123\n            workflowid: wf123\n            timestamp: 2018-03-13T16:50:21.298Z\n            storeid: store123\n            dealercode: dealer123\n            masterdealercode: MdealerCode123\n            originatingSenderId: orgSID\n            userid: user123\n        }\n        loans: class Loans {\n            account: class LoansAccount {\n                commonCustomerId: CC_ID\n                accountType: Type123\n                accountSubType: SubType123\n                billingAddress: class BillingAddress {\n                    addressLine1: addr1\n                    addressLine2: addr2\n                    cityName: chennai\n                    stateCode: 61478\n                    zip: 600017\n                    zipExt: 600018\n                    optOut: opt_Out\n                    optOutReason: opt_Out_reason\n                    optOutType: opt_Out_type\n                }\n                accountNumber: acc123\n                status: ReadyTest\n                lastUpdateTime: 2018-03-13T16:50:21.298Z\n                billCycleDay: 12\n                paymentDueDay: 12\n                primaryPlaceOfUseAddress: class PrimaryPlaceOfUseAddress {\n                    addressLine1: addr1\n                    addressLine2: addr2\n                    cityName: chennai\n                    stateCode: 61478\n                    zip: 600017\n                    zipExt: 600018\n                    optOut: opt_Out\n                    optOutReason: testStr123\n                    optOutType: opt_Out_type\n                }\n                eipIndicator: false\n                daysInCurrentAccount: 12\n                universalLineId: UNID123\n            }\n            accountNumber: acc123\n            loanId: loan123\n            oldLoanId: oLoan123\n            currentLoanSystem: cLoan123\n            commonCustomerId: CCID123\n            balance: 1000.0\n            phoneNumber: 9989898898\n            fulfillmentType: FFType123\n            transactionType: TType123\n            returnAuthorizationType: RAType123\n            promotions: [class Promotions {\n                promotionId: PROMO123\n                promotionAmount: 1000.0\n            }]\n            totalAmountFinanced: 3000.0\n            totalNumberOfInstallments: 15\n            nominalInterestRate: 1000.0\n            annualPercentageRate: 100.0\n            downPaymentAmount: 1000.0\n            additionalDownPaymentAmount: 1000.0\n            downPaymentDiscountAmount: 1000.0\n            totalDownPaymentAmount: 1000.0\n            recurringInstallmentAmount: 1000.0\n            lastInstallmentAmount: 1000.0\n            lastInstallmentDueDate: 2018-04-01\n            remainingNumberOfInstallments: 12\n            purchasedEquipment: class PurchasedEquipment {\n                deviceId: DEV1234\n                imei: imei123\n                serialNumber: sNumber123\n                deviceStatus: READYTEST\n                sku: testStr123\n                description: testStr123\n                fullRetailPrice: 1000.0\n                productType: TYPE01\n                productSubType: SUBTYPE123\n                salePrice: 1000.0\n            }\n            paymentSchedule: [class PaymentSchedule {\n                paymentDueDate: 2018-04-01\n                installmentNumber: 123\n                paymentAmount: 1000.0\n            }]\n            returnedEquipment: class ReturnedEquipment {\n                deviceId: dev123\n                imei: imei123\n                serialNumber: sNo123\n                deviceStatus: ReadyTest\n                sku: 3425127898\n                deviceRecoveryType: RcType123\n                tradeInAmount: 1000.0\n            }\n            effectiveStartDate: 2018-03-01\n            effectiveEndDate: 2018-03-10\n            financingModelType: MType123\n            statusCode: 200\n            remorseReturnNumberOfDays: 2\n            originatingMasterDealerCode: O_MDCODE_123\n            originatingSalesChannel: oSCHNL_123\n            submissionStatus: READYTEST\n            pendingFinancialTransactionStatus: READYTEST\n            workFlowConditions: [BalanceTransferComplete, shipmentPending]\n            agreementNumber: AGREE123\n            clientWorkFlowType: TYPE123\n            tradeInEligibility: false\n            orderId: oID123\n            documentSet: class DocumentSet {\n                documents: [class Documents {\n                    documentId: doc123\n                    documentType: dType01\n                }]\n            }\n            delayPayIndicator: false\n            orderLocationState: stateFailed\n            orderLocationCity: chennai\n            shipToState: tamilnadu\n            programType: Test\n            sourceTransactionId: sTransID123\n            sourceSubTransactionId: subsTransID123\n            sourceTransactionTime: 2018-03-13T16:50:21.298Z\n            freightCarrier: fCarrier123\n            description: Testing_purpose\n            serviceLevelCode: sLevel123\n            shippingCharge: 200.0\n            waiverIndicator: false\n            taxExemptionIndicator: false\n            eligibilities: [class Eligibilities {\n                eligibilityType: elType1\n                ineligibleReasons: [class IneligibleReasons {\n                    reasonCode: rc123\n                }]\n            }]\n            payments: [class Payments {\n                paymentAmount: 1000.0\n            }]\n            acceleratedAmount: amnt1000\n            salesChannelId: sCID123\n            userId: user1234\n            previousLoanSystem: pLS123\n            recurringChargeAmount: amnt1000.00\n            transferQuoteId: quote123\n            transferInitiatedDate: 2018-03-09\n            transferAccountNumber: acc1234\n            transferType: type01\n            unbilledAmount: 1000.0\n            crossDefaultIndicator: false\n            syncPending: false\n            activeDutyMilitaryFlag: false\n            subStatusCode: testStr123\n            activityType: testStr123\n            activityDescription: testStr123\n            activityTime: 2018-03-13T16:50:21.298Z\n            currentBilledAmount: 1000.0\n            shippingDiscountAmount: 1000.0\n            shippingDiscountPercent: 1000.0\n            shippingChargeCode: testStr123\n            additionalPaymentAmount: 1000.0\n            newBalance: 1000.0\n            newRecurringInstallmentAmount: 1000.0\n            newRemainingNumberOfInstallment: 12\n            quoteDate: 2018-03-07\n            customerCreditClass: testStr123\n            writeOff: class WriteOff {\n                code: testStr123\n                description: testStr123\n                effectiveTime: 2018-03-13T16:50:21.298Z\n            }\n            shippingDate: 2018-03-10T16:50:21.298Z\n            trackingNumber: testStr123\n            acceleratedDate: 2018-03-10\n            paymentOverdueDays: 12\n            pastDueIndicator: false\n        }\n    }\n}","logger_name":"com.tmobile.deep.scms.LoanProcessor","thread_name":"pool-1-thread-11","level":"INFO","level_value":20000,"APP_NAME":"loanProcessor_SCMS","eventID: ":"a36t4856-dc8a-4343-afb3-7o9166","eventType: ":"LoanWriteOffCompleted"}

Now I want to get the value of sourceTransactionTime from the log, I used below queries to get it,

index=cloudfoundry sourcetype=cloud*** "cf_foundation=px-npe01" cf_org_name="Commissions" cf_space_name=development cf_app_name="loan***"|rex field=_raw "sourceTransactionTime\:(?<sourceTransactionTime>[^\n]+)"|table sourceTransactionTime

it returns

2018-03-13T16:50:21.298Z\n freightCarrier: fCarrier123\n description: Testing_purpose\n serviceLevelCode: sLevel123\n shippingCharge: 200.0\n waiverIndicator: false\n taxExemptionIndicator: false\n eligibilities: [class Eligibilities {\n eligibilityType: elType1\n ineligibleReasons: [class IneligibleReasons {\n reasonCode: rc123\n }]\n }]\n payments: [class Payments {\n paymentAmount: 1000.0\n }]\n acceleratedAmount: amnt1000\n salesChannelId: sCID123\n userId: user1234\n previousLoanSystem: pLS123\n recurringChargeAmount: amnt1000.00\n transferQuoteId: quote123\n transferInitiatedDate: 2018-03-09\n transferAccountNumber: acc1234\n transferType: type01\n unbilledAmount: 1000.0\n crossDefaultIndicator: false\n syncPending: false\n activeDutyMilitaryFlag: false\n subStatusCode: testStr123\n activityType: testStr123\n activityDescription: testStr123\n activityTime: 2018-03-13T16:50:21.298Z\n currentBilledAmount: 1000.0\n shippingDiscountAmount: 1000.0\n shippingDiscountPercent: 1000.0\n shippingChargeCode: testStr123\n additionalPaymentAmount: 1000.0\n newBalance: 1000.0\n newRecurringInstallmentAmount: 1000.0\n newRemainingNumberOfInstallment: 12\n quoteDate: 2018-03-07\n customerCreditClass: testStr123\n writeOff: class WriteOff {\n code: testStr123\n description: testStr123\n effectiveTime: 2018-03-13T16:50:21.298Z\n }\n shippingDate: 2018-03-10T16:50:21.298Z\n trackingNumber: testStr123\n acceleratedDate: 2018-03-10\n paymentOverdueDays: 12\n pastDueIndicator: false\n }\n }\n}","logger_name":"com.tmobile.deep.scms.LoanProcessor","thread_name":"pool-1-thread-5","level":"INFO","level_value":20000,"APP_NAME":"loanProcessor_SCMS","eventID: ":"a1234e54-dc5a-4d23-afb3-oif16","eventType: ":"LoanVoidOrderCanceledCompleted"}

But I want only the date value "2018-03-13T16:50:21.298Z". Can anyone please suggest me what am doing wrong.

[bangalorep]

Hello!
Try this

rex field=_raw "sourceTransactionTime\:(?<sourceTransactionTime>[^\\n]+)"

[493669]

Hi @karthi25,
try this regex:

   ... |rex field=_raw "sourceTransactionTime\:(?<sourceTransactionTime>[^\\\n]+)"

[tiagofbmm · Accepted solution]

Hi

Try this regex modified

(?<sourceTransactionTime>[^\\\n]*)