Hello All ,
i wanted to capture the numeric values for below strings ctn.
CTN captured into 2 different formats.
First "ctn": "2148504794" - it has space between ":" and numeric values
Second ctn":"2148504794" - it doesn't have space between ":" and numeric values
like
"ctnId":279,"ctn":"2148504794",
processDMaaPMessage {"device": [{"ctn": "2148504794","status": "Restored"}]}}
i am using this rex
rex "ctn\"[:|: ] \"(?\d+)\","
but it seems it didn't work
please suggest a fix
Try this run anywhere search
| makeresults
| eval data="\"ctn\": \"2148504794\""
| append
[| makeresults
| eval data="ctn\":\"2148504794\""]
| rex field=data "ctn\":(|\s+)\"(?<ctn>[^\"]+)"
In your environment you should try,
<your base search>| rex field=_raw "ctn\":(|\s+)\"(?<ctn>[^\"]+)"
let me know if this helps!
Also, you might want to start using a service like regex101.com. It would've shown you that your regex has invalid syntax. 🙂
Thanks Mayur, it works 🙂
i am trying to capture below reasonMessage also, but it capture
the colon with space only like "reasonMessage": "Uplift transaction failed due to SWC system error"}]}}*
i wanted to capture below strings as well.
"reasonMessage": "Uplift transaction failed due to SWC system error"}]}}
Thanks alot for your time and inputs.
Try this regex \"reasonMessage\"\:\s\"(?<reasonMessage>[^\"]+)
You rocks Mayur. Thanks again
@ms208a, if your issue is resolved, please accept the answer to mark this question as answered and help others facing similar issue in future.
Do up vote the comment/s that helped 🙂