Splunk Search

Regex Help

brajaram
Communicator

Hi,

Struggling yet again with another regex. The sample string looks like the following:

.........,"errorCode":"500113"}, .......

As part of a whole JSON response.

If I take that JSON and put it into regex101, I can use the following rex to correctly capture the code

"errorCode\":(.*?)},

However, I'm not sure how to turn that into a rex command to parse out the field. If I simply replace the .* with ?<> with a field name inside the brackets it errors out, and in fact I can't ever get it to not throw an error.

How do I turn an accurate regular expression(at least from my testing using online regular expression tools) into a rex command to capture a field in Splunk?

Tags (2)
0 Karma
1 Solution

micahkemp
Champion

Don't replace .* with ?<fieldName>. You add ?<fieldName> after your (, like:

"errorCode\":(?<errorCode>.*?)},

Full rex (alteration to exclude double quotes from the extracted value):

| rex "\"errorCode\":\"(?<errorCode>.*?)\"},"

Probably better version, which specifies that errorCode can't contain ":

| rex "\"errorCode\":\"(?<errorCode>[^\"]+)\"},"

View solution in original post

0 Karma

micahkemp
Champion

Don't replace .* with ?<fieldName>. You add ?<fieldName> after your (, like:

"errorCode\":(?<errorCode>.*?)},

Full rex (alteration to exclude double quotes from the extracted value):

| rex "\"errorCode\":\"(?<errorCode>.*?)\"},"

Probably better version, which specifies that errorCode can't contain ":

| rex "\"errorCode\":\"(?<errorCode>[^\"]+)\"},"
0 Karma

brajaram
Communicator

Ahh, thanks for the explanation! Works perfectly. Appreciate the help!

0 Karma

horsefez
SplunkTrust
SplunkTrust

The feeling you have when you are too late to a regex question :S

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...