how can I get the value of a user embedded field named "index"?

[juniormint]

I have log events that contain an user embedded field named "index". Out of the box Splunk seems to effectively ignore user's index when auto extracting field.

My goal is to find a good way to get the value for user's index field. I'm not really sure of the right way to deal with this situation, so please feel free to suggest anything (I'm already working on getting rid of the poorly named field).

My initial thought was to use rex, but I'm having a bit of a time getting the right regex. Suggestions for a correct rex expression?

rex field=_raw ".*index=\"(<app>.*)\""

_raw is something like:

data="xxxx",index="allgoodman",session="12345"

Thanks for any help.
-J

[yannK · Accepted solution]

You have the right approach,
the splunk index will overwrite your automatic field extraction.

if you data is like data="xxxx",index="allgoodman",session="12345"

you can define a new field and use a rex.

<mysearch> | rex "index=\"<?index_app>\w+\"" | table index index_app _raw

and if you create an automatic field extraction, you can drop the escaped double quotes.

[yannK]

The field is optional, by default is applied to _raw.
You need to specify it if you already have the text in a field to narrow the extraction.

[juniormint]

This seems to work. Thanks so much!

<mysearch> | rex field=_raw "index=\"(?<index_app>\w+)\"" | table index, index_app, _raw

[juniormint]

does that rex expression really work? do you need a field or sed in there and probably an _raw?