Why am I not receiving results when a value contains a with period and underscore?

[saikamaldidigam]

I would like to show results group by "SLA Request Key". I am able to view sample Data-2 but not Sample Data-1

Sample Data-1:
{"key":"SLA Request Key","value":"mls.ILSP_CONTNR_SKU_INSERT"}]}

Sample Data-2:
{"key":"SLA Request Key","value":"GetPickGroupsByBinLocation"}]}

index = xyz "Database Call Exceeded SLA" | rex field=_raw "SLA Request Key\",\"value\":\"(?\\w+)\"}]}" | stats count by slaKey

when i run this search, i am only getting the results for Sample Data-2(GetPickGroupsByBinLocation) not "mls.ILSP_CONTNR_SKU_INSERT" this. I assume this is not parsing stats count by when value is combined with Dot and Underscore

Can any one please help me?

Thanks in Advance!

[vasanthmss]

Since you are having json, why don't you use spath in your search? I would suggest put the extraction in the props.conf. Any how answering your question, try...

 your base search   | spath | stats c by key

Sample search ..

|stats c | eval _raw="{\"key\":\"SLA Request Key\",\"value\":\"mls.ILSP_CONTNR_SKU_INSERT\"}]}" | append [|stats c | eval _raw="{\"key\":\"SLA Request Key\",\"value\":\"GetPickGroupsByBinLocation\"}]}" ] | spath | stats c by key

[saikamaldidigam]

Thank you so much for your reply.

But your solution is not the one exactly which i am looking for.

Though this will be incredibly useful for me in future.

Thanks again for your valuable response.

[saikamaldidigam]

If you can give me solution for your reply

"your base search | spath | stats c by key"

There are many keys in my raw data i was looking for key "SLA Request Key" and i want to exclude remaining keys and i want stats count by key
something like this

"my Base search ""SLA Request Key"" | spath | stats c by key -remove key2, key3 .........keyn"

[richgalloway · Accepted solution]

Your regex string is only looking for word characters (letters, numbers, and underscores) so periods don't match. Try

... | rex "SLA Request Key\",\"value\":\"(?<field>[\.\w]+)\"}]}" | ...

[saikamaldidigam]

Thank you so much it worked for me !