Splunk Search

How can I extract this field using REGEX (rex)?

sarathipattam
New Member

Hi,

I have the below raw, I would like to extract MaximumBatchQuantity value, which is 20. Can someone help me with REGEX, please?

{"bdy":{"msg":"HttpRequest","addInfo":[{"key":"Url","value":"https://isp0064x.st.ad.XXXXX.com/XXXXXOmniFulfillmentServerApp/api/Assignment/Auto/"},{"key":"Content","value":"{\"Filters\":[],\"**MaximumBatchQuantity**\":**20**,\"AllowedSLAMilliSeconds\":4500,\"AssociateFirstName\":\"Aliona\",\"AssociateId\":\"2795969\",\"AssociateLastName\":\"Cieniawa\",\"Header\":{\"ApiVersion\":null,\"AppVersion\":\"18.3.0.15617\",\"JsonWebToken\":null,\"MessageId\":\"de959d4f-6a7d-4c0c-98d3-1143064b4300\"},\"IsOffline\":false,\"SLARequestKey\":\"AutoBatch\",\"StoreNumber\":\"0064\"}"},{"key":"CorrelationId","value":""},{"key":"MessageId","value":"3a04038d-64e2-493c-b489-90a922de1980"}]},"hdr":{"level":"Verbose","timestamp":"2018-06-04T21:03:19.6347626Z","fxsrc":"LogRequestInfo","lineNum":710,"userId":"2795969","loc":"Store","locId":"0064","ip":"10.224.255.15","hostName":"K-W10ME-7463352","macaddress":"00-16-XX-16-A6-FA","eventid":0,"appVersion":"18.3.0.15617","appName":"OmniFulfillment","deviceModel":"XX500","osVersion":"10.0.14393.2007","firmwareVersion":"1049.7.18039.0","networkSignalStrength":"4","isConnected":"True"},"ver":"0.1"}
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Assuming those asterisk in the field name and value of MaximumBatchQuantity is added by you trying to highlight/bold it, give following regex a try

MaximumBatchQuantity[^:]+:(?<MaximumBatchQuantity>[^,]+)

See it working with your sample data

https://regex101.com/r/URJNJH/1

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I heard you liked JSON, so I put some JSON in your JSON? Eww.

... | rex "\\\"MaximumBatchQuantity\\\"\s*:\s*\"?(?<MaximumBatchQuantity>\d+)"
0 Karma

sarathipattam
New Member

Thanks for the response, this is giving me null value

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Assuming those asterisk in the field name and value of MaximumBatchQuantity is added by you trying to highlight/bold it, give following regex a try

MaximumBatchQuantity[^:]+:(?<MaximumBatchQuantity>[^,]+)

See it working with your sample data

https://regex101.com/r/URJNJH/1

0 Karma

sarathipattam
New Member

I used this way

| rex field=_raw MaximumBatchQuantity[^:]+:(?[^,]+)

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

put quotes around the expression

0 Karma

sarathipattam
New Member

Thanks for the response, I'm getting below error,

Error in 'SearchParser': Missing a search command before '^'. Error at position '522' of search query 'search index=kohls_prod_stores_servers sourcetype=...{snipped} {errorcontext = hQuantity[^:]+:(?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What's the search you're using? I just gave you the regex portion, you'd need to add other search parts.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...