JSON 從 Splunk 日志中提取

Question

我有一個要求，我需要從 splunk 日志中提取部分 JSON 代碼並將該字段分配給 spath 以獲得進一步的結果

我的正則表達式在 regex101 中有效，但在 splunk 中無效

下面是日志片段——希望獲取從 {"unique_appcodes 到行尾的 JSON 代碼..我已經在下面的帖子中顯示了預期的 output

 cwmessage: 2021-08-26 17:14:10 araeapp INFO MRC: Unique AppCodes Report requested.
2021-08-26 17:14:10 araeapp INFO MRC_ARAE_I_042: (local) requesting uniq_appcodes report for KKA
2021-08-26 17:14:10 araeapp INFO {"unique_appcodes": [{"count": 2, "app_code": "XYZ", "group": "", "instance": "KKA"}, {"count": 2, "app_code": "QQQ", "group": "TSR05441", "instance": "KKA"}, {"count": 1, "app_code": "QQQ", "group": "", "instance": "KKA"}, {"count": 192, "app_code": "PPP", "group": "TSR05560", "instance": "KKA"}, {"count": 12, "app_code": "PPP", "group": "", "instance": "KKA"}, {"count": 12, "app_code": "GM9", "group": "TSR06083", "instance": "KKA"}, {"count": 139, "app_code": "ZZZ", "group": "TSR06103", "instance": "KKA"}, {"count": 6, "app_code": "GNA", "group": "TSR06085", "instance": "KKA"}, {"count": 803, "app_code": "SSS", "group": "MXXX0718", "instance": "KKA"}, {"count": 3, "app_code": "SSS", "group": "", "instance": "KKA"}]}
 

雷克斯使用：

| rex field=_raw (?msi)(?<json_field>\{\"unique_appcodes\".+\}$)
 

這在 regex101.com 中完美地工作，它正在提取下面的必需部分但是當我在 SPlunk 中使用它時它沒有給出任何結果我認為它是 JSON 屬性之間的空格

請讓我知道你的想法

{"unique_appcodes": [{"count": 2, "app_code": "XYZ", "group": "", "instance": "KKA"}, {"count": 2, "app_code": "QQQ", "group": "TSR05441", "instance": "KKA"}, {"count": 1, "app_code": "QQQ", "group": "", "instance": "KKA"}, {"count": 192, "app_code": "PPP", "group": "TSR05560", "instance": "KKA"}, {"count": 12, "app_code": "PPP", "group": "", "instance": "KKA"}, {"count": 12, "app_code": "GM9", "group": "TSR06083", "instance": "KKA"}, {"count": 139, "app_code": "ZZZ", "group": "TSR06103", "instance": "KKA"}, {"count": 6, "app_code": "GNA", "group": "TSR06085", "instance": "KKA"}, {"count": 803, "app_code": "SSS", "group": "MXXX0718", "instance": "KKA"}, {"count": 3, "app_code": "SSS", "group": "", "instance": "KKA"}]}
 

Answer 1

首先，正則表達式必須用引號引起來。 嵌入的引號必須經過三次轉義 ( \{\\\"unique_appcodes )。

其次，標志在 Splunk 正則表達式中沒有幫助。

與使用.+相比，我使用[\s\S]+匹配所有字符的運氣更好。