Splunk Search

rex from the multivalue fields and get one particular value

mikeyty07
Communicator

I have this multivalue fields where i am tring to rex and get particular field value like 
"value":"ESC1000",  but instead getting multiple.
Tried with this but shows all the fields value 
| rex max_match=0 "value\":\"(?<ESC>[^\"]+)"


"productChanges":[
{
"Products":[
{
"productSpecContainmentID":"1",
"changedCharacteristics":[
{
"characteristicID":"2",
"value":"SERVICE"
},
{
"characteristicID":"3",
"value":"99"
},
{
"characteristicID":"4",
"value":"monthly"
},
{
"characteristicID":"5",
"value":"ESC1000"
},
{
"characteristicID":"6",
"value":"Discount"
},
{
"characteristicID":"7",
"value":"Escalation"
},
{
"characteristicID":"8",
"value":"AMOUNT"
},
{
"characteristicID":"9",
"value":"9"
},
{
"characteristicID":"10",
"value":"Y"
},
{
"characteristicID":"11",
"value":"N"
}
],
"temporaryID":"xxxaaaacccc"
}
]
}
]

Is there a way to get the required fields value only like above?

Labels (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming your value always starts with ESC, give this a try:

| rex "value\":\"(?<ESC>ESC[^\"]+)"

View solution in original post

somesoni2
Revered Legend

Assuming your value always starts with ESC, give this a try:

| rex "value\":\"(?<ESC>ESC[^\"]+)"

mikeyty07
Communicator

Also i have this url which has 
https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create

is there a way to regex and get these?
1015953 as customerId
58870 as productId

0 Karma

somesoni2
Revered Legend

Try like this (UPDATED)

 

| rex "http(s)*:\/\/([^\/]+\/)+customer\/(?<customerId>[^\/]+)\/product\/(?<productId>[^\/]+)"

 

mikeyty07
Communicator

uri=https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create?ac=n
I have the uri like this but the rex didnt show two new fields

0 Karma

somesoni2
Revered Legend

I missed a colon in the regex. Added just now. Try the updated version.

0 Karma

mikeyty07
Communicator

thank you got the expected results

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...