Regex Return Everything Except for Double Quotes

Question

I wonder whether someone could help me please.

I'm trying to extract the following information from the data set below:

1 A Street, A Town, GB

{"matchingDataset":{"surnames":[{"value":"Smith","verified":true}],"gender":{"value":"MALE","verified":true},"dateOfBirth":{"value":"1973-12-26","verified":true},"firstName":{"value":"John","verified":true},"addresses":[{"verified":true,"postCode":"AB1 1BC","lines":["1 A Street","A Town","GB"]}],"middleNames":{"value":"john","verified":true}},"hashedPid":"123","matchId":"_123","levelOfAssurance":"LEVEL_2"}

I've put together the following regex:

"\"lines\":\[\"(?<idaAddress>[^\]]+)"

The problem I have is that this returns:

1 A Street", "A Town", "GB

Could someone tell me please is there a way remove the double quotes from this.

Many thanks and kind regards

Chris

Answer 1

In the regex I could see \" which splunk treat as " (use \ to suppress special meaning for ") so they are coming in output.

Answer 2

I don't know what splunk is, but surely it must have some kind of JSON parsing library (if not a built-in function). That's generally a much better way of doing these things than regexes.

I'll answer your question more directly, but only in the interests of helping you to understand regexes. The capture group is (?<idaAddress>[^\]]+). The " at the start of "1 A Street" matches a \" in the regex, so the capture group starts matching immediately after it. If you do this: "\"lines\":\[(?<idaAddress>[^\]]+)" then the " in the string will be matched as part of the [^\]]+ part. Or in fact "\"lines\":\[(?<idaAddress>\"[^\]]+)" will also make the " match inside the capture group.

As for the end of the string, the only explanation I can think of is that the " at the end works just the same as \" (i.e. you don't actually need the \). So if you remove the closing " (or move it inside the capture group) then the ending " will be captured, as intended. But this is just an educated guess.

Answer 3

I dont really know how does this splunk thing work but you can do this by two stages:

1- Catch the quoted expression "1 A Street", "A Town", "GB" withe the following regex:

\"lines\":\[(?<idaAddress>[^\]]+)

2- Then catch the values between quotes inside the token using this regex:

\"(.*?)\"

---

I dont know what is the tagged programming language used for, but i assume that set of instructions would not differ much than this:

regex _raw="\"lines\":\[(?<idaAddress>[^\]]+)"
regex idaAddress="\"(.*?)\""