Extract data from splunk

0
votes

I have a Post query where I want to extract request payload or parameters and print a table. In the query, I am trying to extract the user_search name field

I have written a Splunk query but it is not working for me

"Parameters: {\"user_search\"=>{\"name\"=>*"  | rex  field=_raw "/\"user_search\"=>{\"name\"=>/(?<result>.*)"  | table result

Splunk Data

I, [2021-09-23T00:46:31.172197 #44154]  INFO -- : [651235bf-7ad5-4a2e-a3b8-7737a3af9fc3]   Parameters: {"user_search"=>{"name"=>"aniket", "has_primary_phone"=>"false", "query_params"=>{"searchString"=>"", "start"=>"0", "filters"=>[""]}}}
host = qa-1132-lx02source = /src/project.logsourcetype = data:log

I, [2021-09-23T00:48:31.162197 #44154]  INFO -- : [651235bf-7ad5-4a2e-a3b8-7737a3af9fc3]   Parameters: {"user_search"=>{"name"=>"shivam", "has_primary_phone"=>"false", "query_params"=>{"searchString"=>"", "start"=>"0", "filters"=>[""]}}}
host = qa-1132-lx02source = /src/project.logsourcetype = data:log

I, [2021-09-23T00:52:27.171197 #44154]  INFO -- : [651235bf-7ad5-4a2e-a3b8-7737a3af9fc3]   Parameters: {"user_search"=>{"name"=>"tiwari", "has_primary_phone"=>"false", "query_params"=>{"searchString"=>"", "start"=>"0", "filters"=>[""]}}}
host = qa-1132-lx02source = /src/project.logsourcetype = data:log

I have 2 questions

  1. How to write a splunk query to extract request payload in post query
  2. In my above query I am not not sure what I am doing wrong. I would really appreciate if someone has any suggestion.
1
splunksplunk-query

1 Answers

1
votes

At the least, your regular expression has an error

You have:

"/\"user_search\"=>{\"name\"=>/(?<result>.*)"

There is an extra "/" after the "=>"

This seems to pull what you're looking for:

user_search\"=>{\"name\"=>(?<result>.*)

Edit per comment "I only want to fetch the values such as aniket & shivam from the name key"

There're a couple ways to do what you're asking, and which is going to be mroe performant will depend on your environment and data

Option 1

index=ndx sourcetype=srctp ("aniket" OR "shivam")
| rex field=_raw "user_search\"=>{\"name\"=>(?<result>.*)"
| stats count by result

Option 2

index=ndx sourcetype=srctp
| rex field=_raw "user_search\"=>{\"name\"=>(?<result>.*)"
| search result="aniket" OR result="shivam"
| stats count by result