CODEWITHSUNDEEP
jsonregexparsingsplunk
laker02
laker02

Reputation: 117

Splunk not recognizing regex

I'm struggling to make a regex work with splunk. It works with regex 101, but splunk doesn't seem to recognize it!

Regex: \"([\w]+)\":([^,}]+)

Log entry:

May 20 12:22:21 127.0.0.1 {"rootId": "AXIxikL8ao-yaSvA", "requestId": "f6a873jkjjkjk:-8000:5738", 
"details": {"flag": false, "title": "task 1", "status": "Waiting", "group": "", "order": 0}, 
"operation": "Creation", "objectId": "AXIyCN5Oao-H5aYyaSvd", "startDate": 1589977341890, 
"objectType": "case_task", "base": true, "object": {"_routing": "AXIxikL8ao-H5aYyaSvA", "flag": 
false, "_type": "case_task", "title": "task 1", "createdAt": 1589977341516, "_parent": "AXIxikL8ao- 
H5aYyaSvA", "createdBy": "user", "_id": "AXIyCN5Oao-H5aYyaSvd", "id": "AXIyCN5Oao-H5aYyaSvd", 
"_version": 1, "order": 0, "status": "Waiting", "group": ""}}

Regex 101 link: https://regex101.com/r/XBuz9Y/2/

I suspect splunk may have a different regex syntax, but i don't really know how to adapt it.

Any help?

Thanks!

Upvotes: 0

Views: 940

Answers (2)

Simon Duff
Simon Duff

Reputation: 2651

Grab the JSON fragment of your event using rex, and then use spath to do the extraction.

rex field=_raw "^[^{]+(?<json>.*)" | spath input=json

This should extract the JSON fields with the appropriate structure.

Upvotes: 0

Wiktor Stribiżew
Wiktor Stribiżew

Reputation: 626926

You may use

... | rex max_match=0 "\"(?<key>\w+)\":(?<value>[^,}]+)"

Here, max_match=0 will enable multiple matching (by defauly, if you do not use max_match parameter, only the first match is returned) and the named capturing groups (here, see (?<key>...) and (?<value>...)) will ensure field creation.

See more about the Splunk rex command.

Upvotes: 1

Related Questions