Splunk Search

rex help

surekhasplunk
Communicator

Hello,

index=myindex| spath "Rules{}" output=rules |mvexpand rules
 | table device ip rules

Now my rules has data like below:

rules

{"name": "abc def - 123", "result": true}

i want to now make it into two columns rule_name and rule_result

can you please help me with the regex. 

 

 

Labels (1)
Tags (2)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

please try this regex:

| rex "\"name\":\s+\"(?<name>[^\"]+)\",\s+\"result\":\s+(?<result>\w+)"

that you can test at https://regex101.com/r/3DyKHn/1

Ciao.

Giuseppe

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Why rex and not spath again?

| spath input=rules ...

inventsekar
SplunkTrust
SplunkTrust

Hi @ITWhisperer .. i am from a sabbatical vacation and also i havent used spath. so i miss some context here. 

may i know how spath can do the job of rex?(this is what my understanding from ur reply)..

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @inventsekar 

spath is used for parsing and extracting fields from JSON and XML strings. In this instance, spath was used to extract the rules from _raw (which must have been JSON)

index=myindex| spath "Rules{}" output=rules |mvexpand rules

  It yielded the next level down which appears to be more JSON

{"name": "abc def - 123", "result": true}

 So spath could have been used to extract these fields too

| spath input=rules

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

please try this regex:

| rex "\"name\":\s+\"(?<name>[^\"]+)\",\s+\"result\":\s+(?<result>\w+)"

that you can test at https://regex101.com/r/3DyKHn/1

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...