Splunk Search

Help with Rex field-extraction

d00680245
Explorer

I'm having a difficult time extracting the value for reportId. I'm not sure how to find the digits to the right of "reportId":
The reportId value has a range between 5 to 9 digits. I basically want to find anything between "reportId": AND ,
I've tried Splunk Field-Extractor and many similar examples on answers, but just cannot seem to get anything working.

raw sample data:

2015-05-28 08:27:19,378 INFO com.test.test.reports.Generation.ReportImageServiceListener - message received: {"location":"1","area":1,"Symbol":" LT","Number":"12345","Ids":[1.0,2.0,6.0],"Category":"ALL","reportLevel":"FIELD_GROUP","reportDelivery":"EMAIL_BUNDLE","reportType":"FORM","reportLayout":"LANDSCAPE","Year":2015,"userId":50000,"reportId":0000001,"layers":["CLU_BOUNDARIES","TEST_CLU_BOUNDARIES","ASSOCIATED_LABELS","CLU_LABELS","ASSOCIATED_CLUS","ANNUAL_CLUS","TEST_ACRES_CLUS","POLYGONS","AERIAL_IMAGERY","COUNTIES","PLSS","ROADS","TOWNS","WATERWAYS"],"plantedReport":false,"CluLabelOne":"FSN","FieldLabelFour":"NONE","FieldDisplayOption":"ALL","CluLabelThree":"FIELD","CluLabelTwo":"TRACT","FieldLabelOne":"LABEL","FieldLabelTwo":"ACRES","CluLabelFour":"FIELD_ACRES","FieldColorOption":"CROP","CluLabelFive":"PLANTED_ACRES","FieldLabelThree":"NONE","FieldYieldOption":"CURRENT_USE","FieldLabelFive":"NONE"}

 

Labels (1)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This regex string works well according to regex101.com. Depending on whether you're extracting at index time or search time, you'll want to put it into a REGEX statement or a rex command.

reportId\":(?P<reportID>\d+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

Michael_Wilde
Splunk Employee
Splunk Employee

You might consider making a bit more of a generic regex so you can use it with other fields. If you just tell splunk "after this stuff, grab anything thats inside the quotes.. or grab anything before this comma" you might use that regex on other fields too! Like this:

 | rex "reportId\"\:(?<reportId>[^,\"]+)"

Inside that regex, I'm looking for a single character list, but the ^ "caret" negates it, so it says "anything that is not a comma, or a quote".. and then we repeat that as many times as we can with the "+" plus sign. Make a slight change to the preceding characters and the field name and use the same internal regex, like this:

| rex "reportLayout\"\:\"(?<reportLayout>[^,\"]+)"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This regex string works well according to regex101.com. Depending on whether you're extracting at index time or search time, you'll want to put it into a REGEX statement or a rex command.

reportId\":(?P<reportID>\d+)
---
If this reply helps you, Karma would be appreciated.

d00680245
Explorer

Thank you! This works for me! I was using www.regexr.com and plugged your solution in there and doesn't seem to work, but I'll definitely try out regex101.com.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The biggest advantage (IMO) that regex101 has over regexr is support for the same regex syntax as Splunk.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

regexr.com was my first love... and then I discovered that regex101.com understands the named capturing groups where the former does not. it's also nice to be able to save and share your regex with a link.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...