Splunk Dev

rex command


How to fetch activity id using rex command

Log record:

DATA= {"note":"Succeeded | {\r\n \"service.url\": \"\",\r\n \"enable.debug\": false,\r\n \"permission.base.url\": \"\",\r\n \"userInfo.base.url\": \"\",\r\n \"storeId.base.url\": \"\",\r\n \"app.session.timeout\": 25\r\n},activityId: 64AB3318-4DA3-4D38-9800-5DABCC7EC263,","appVersion":"1.10"

I tried below query with no luck,

| rex field=DATA ",activityId: (?<ACTIVITY_ID_VALUE>.*)"

Trying to fetch value "64AB3318-4DA3-4D38-9800-5DABCC7EC263" and show in table

0 Karma


Hello @saifdj

please double check you that you have an extracted field DATA.

If not you can use a general regex applied to whole _raw event (which is not so effizient as you indended):

rex "activityId: (?<a1>[\w\-]+)"

Please let me know how if it worked

0 Karma


Slightly more generic (since it looks like a comma is the delimiter):

... | rex "activityId: (?<ACTIVITY_ID_VALUE>[^,]+)"
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...