extract json inside another json object using regex

sivaranjiniG — Tue, 14 Dec 2021 10:25:44 GMT

Hello

I have this below data,

{ [-] guessedService: ejj logGroup: /aws/ejj/cluster logStream: kube-apt-15444d2f8c4b216a9cb69ac message:{"kind":"Event","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/jej/endpoints/eji.com-aws-eji","verb":"update","user":{"username":"system:serviceaccount:efs:efs-provisioner","uid":"ab5d27b4c-71a4f77323b0","groups":["system:serviceaccounts","system:serviceaccounts:eji","system:authenticated"]},"sourceIPs":["10.0.0.0"],"userAgent":"eji-provisioner/v0.0.0 (linux/amd64) kubernetes/$Format","objectRef":{"resource":"endpoints","namespace":"edd","name":"dds.com-aws-edds","uid":"44ad8-899f-fbc1f4befb2f","apiVersion":"v1","resourceVersion":"8852157"},"responseStatus":{"metadata":{},"code":200}}

Need to extract user:{username:.....} user part alone
need to write once regex to extarct all the values inside user object..like user.username, user.uid, user.groups

Re: extract json inside another json object using regex

ITWhisperer — Tue, 14 Dec 2021 10:30:37 GMT

| rex "\"user\":(?<user>[^\}]+\})" | spath input=user

Re: extract json inside another json object using regex

sivaranjiniG — Tue, 14 Dec 2021 11:02:26 GMT

Thanks for the reply, but i need to use props and transforms either index or search time extraction

topic Re: extract json inside another json object using regex in Splunk Dev

extract json inside another json object using regex

Re: extract json inside another json object using regex

Re: extract json inside another json object using regex