Splunk Search

rex from the multivalue fields and get one particular value

mikeyty07
Communicator

I have this multivalue fields where i am tring to rex and get particular field value like 
"value":"ESC1000",  but instead getting multiple.
Tried with this but shows all the fields value 
| rex max_match=0 "value\":\"(?<ESC>[^\"]+)"


"productChanges":[
{
"Products":[
{
"productSpecContainmentID":"1",
"changedCharacteristics":[
{
"characteristicID":"2",
"value":"SERVICE"
},
{
"characteristicID":"3",
"value":"99"
},
{
"characteristicID":"4",
"value":"monthly"
},
{
"characteristicID":"5",
"value":"ESC1000"
},
{
"characteristicID":"6",
"value":"Discount"
},
{
"characteristicID":"7",
"value":"Escalation"
},
{
"characteristicID":"8",
"value":"AMOUNT"
},
{
"characteristicID":"9",
"value":"9"
},
{
"characteristicID":"10",
"value":"Y"
},
{
"characteristicID":"11",
"value":"N"
}
],
"temporaryID":"xxxaaaacccc"
}
]
}
]

Is there a way to get the required fields value only like above?

Labels (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming your value always starts with ESC, give this a try:

| rex "value\":\"(?<ESC>ESC[^\"]+)"

View solution in original post

somesoni2
Revered Legend

Assuming your value always starts with ESC, give this a try:

| rex "value\":\"(?<ESC>ESC[^\"]+)"

mikeyty07
Communicator

Also i have this url which has 
https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create

is there a way to regex and get these?
1015953 as customerId
58870 as productId

0 Karma

somesoni2
Revered Legend

Try like this (UPDATED)

 

| rex "http(s)*:\/\/([^\/]+\/)+customer\/(?<customerId>[^\/]+)\/product\/(?<productId>[^\/]+)"

 

mikeyty07
Communicator

uri=https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create?ac=n
I have the uri like this but the rex didnt show two new fields

0 Karma

somesoni2
Revered Legend

I missed a colon in the regex. Added just now. Try the updated version.

0 Karma

mikeyty07
Communicator

thank you got the expected results

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...