Splunk Search

rex from the multivalue fields and get one particular value

mikeyty07
Communicator

I have this multivalue fields where i am tring to rex and get particular field value like 
"value":"ESC1000",  but instead getting multiple.
Tried with this but shows all the fields value 
| rex max_match=0 "value\":\"(?<ESC>[^\"]+)"


"productChanges":[
{
"Products":[
{
"productSpecContainmentID":"1",
"changedCharacteristics":[
{
"characteristicID":"2",
"value":"SERVICE"
},
{
"characteristicID":"3",
"value":"99"
},
{
"characteristicID":"4",
"value":"monthly"
},
{
"characteristicID":"5",
"value":"ESC1000"
},
{
"characteristicID":"6",
"value":"Discount"
},
{
"characteristicID":"7",
"value":"Escalation"
},
{
"characteristicID":"8",
"value":"AMOUNT"
},
{
"characteristicID":"9",
"value":"9"
},
{
"characteristicID":"10",
"value":"Y"
},
{
"characteristicID":"11",
"value":"N"
}
],
"temporaryID":"xxxaaaacccc"
}
]
}
]

Is there a way to get the required fields value only like above?

Labels (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming your value always starts with ESC, give this a try:

| rex "value\":\"(?<ESC>ESC[^\"]+)"

View solution in original post

somesoni2
Revered Legend

Assuming your value always starts with ESC, give this a try:

| rex "value\":\"(?<ESC>ESC[^\"]+)"

mikeyty07
Communicator

Also i have this url which has 
https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create

is there a way to regex and get these?
1015953 as customerId
58870 as productId

0 Karma

somesoni2
Revered Legend

Try like this (UPDATED)

 

| rex "http(s)*:\/\/([^\/]+\/)+customer\/(?<customerId>[^\/]+)\/product\/(?<productId>[^\/]+)"

 

mikeyty07
Communicator

uri=https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create?ac=n
I have the uri like this but the rex didnt show two new fields

0 Karma

somesoni2
Revered Legend

I missed a colon in the regex. Added just now. Try the updated version.

0 Karma

mikeyty07
Communicator

thank you got the expected results

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...