Splunk Search

rex from the multivalue fields and get one particular value

mikeyty07
Communicator

I have this multivalue fields where i am tring to rex and get particular field value like 
"value":"ESC1000",  but instead getting multiple.
Tried with this but shows all the fields value 
| rex max_match=0 "value\":\"(?<ESC>[^\"]+)"


"productChanges":[
{
"Products":[
{
"productSpecContainmentID":"1",
"changedCharacteristics":[
{
"characteristicID":"2",
"value":"SERVICE"
},
{
"characteristicID":"3",
"value":"99"
},
{
"characteristicID":"4",
"value":"monthly"
},
{
"characteristicID":"5",
"value":"ESC1000"
},
{
"characteristicID":"6",
"value":"Discount"
},
{
"characteristicID":"7",
"value":"Escalation"
},
{
"characteristicID":"8",
"value":"AMOUNT"
},
{
"characteristicID":"9",
"value":"9"
},
{
"characteristicID":"10",
"value":"Y"
},
{
"characteristicID":"11",
"value":"N"
}
],
"temporaryID":"xxxaaaacccc"
}
]
}
]

Is there a way to get the required fields value only like above?

Labels (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming your value always starts with ESC, give this a try:

| rex "value\":\"(?<ESC>ESC[^\"]+)"

View solution in original post

somesoni2
Revered Legend

Assuming your value always starts with ESC, give this a try:

| rex "value\":\"(?<ESC>ESC[^\"]+)"

mikeyty07
Communicator

Also i have this url which has 
https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create

is there a way to regex and get these?
1015953 as customerId
58870 as productId

0 Karma

somesoni2
Revered Legend

Try like this (UPDATED)

 

| rex "http(s)*:\/\/([^\/]+\/)+customer\/(?<customerId>[^\/]+)\/product\/(?<productId>[^\/]+)"

 

mikeyty07
Communicator

uri=https://www-api.corp.google.com/google/com/customer/1015953/product/58870/create?ac=n
I have the uri like this but the rex didnt show two new fields

0 Karma

somesoni2
Revered Legend

I missed a colon in the regex. Added just now. Try the updated version.

0 Karma

mikeyty07
Communicator

thank you got the expected results

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...