Splunk Search

How do you turn this test string into a regular expression

Danielle2018V
New Member

Hello

How do you convert the following test string to a regular expression, if the test string contains spaces? Because the string "type" appears several time in the log, to differentiate the instance I need, I need "type" that's followed by a negative amount.

Test string:
"type"=>"fun_bucks", "amount"=>"-$

rex field=_raw type\"=>\"(?[^\"]+)\"\,\ \ \"amount\"=>\"-\$

Example log text
"type"=>"fun_bucks", "amount"=>"-$21.00", "request_id_link"=>{"content"=>nil, "href"=>"https://ebc.cybersource.com/ebc/transactionsearch/TransactionSearchDetailsLoad.do?requestId="}, "status"=>"succeeded", "action"=>"refund", "convert_to_cash_url"=>nil}], "v2_return_service_enabled"=>true, "inventory_service_id"=>"voucher", "order_reversal_url"=>"/order_reversal/refund",

0 Karma
1 Solution

hos_2
Path Finder

Hi Danielle2018V,

You need to define the spaces in your regex with \s, for example:

type\"\=\>\"(?<test>\w+)\"\,\s\"amount\"\=\>\"(?<test2>\S+)\"

This will create 2 fields called test and test2, test will be the name of the account (in this case "fun_bucks") and test2 will be the dollar amount (in this case -$21.00)

Then you can use search or where commands to do the rest of the filtering

View solution in original post

0 Karma

hos_2
Path Finder

Hi Danielle2018V,

You need to define the spaces in your regex with \s, for example:

type\"\=\>\"(?<test>\w+)\"\,\s\"amount\"\=\>\"(?<test2>\S+)\"

This will create 2 fields called test and test2, test will be the name of the account (in this case "fun_bucks") and test2 will be the dollar amount (in this case -$21.00)

Then you can use search or where commands to do the rest of the filtering

0 Karma

hos_2
Path Finder

I forgot to mention that there is a great place to test your code and it has a codex of regex commands to reference.

https://regex101.com/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...