topic How do I extract a value of a key from multi-format data? in Getting Data In

How do I extract a value of a key from multi-format data?

issbouzidi — Wed, 10 Oct 2018 10:25:52 GMT

Hi,

I'm new in Splunk. I need help with extraction data, and I have a multi-format file. Example:

08-Oct-2018 16:27:46.6300000|I|CompanyService|MsgReceivePooling OperationRequestMsg [Id(5976) .Net(14)]|App|Company|Algorithm|Treshold||{ "OperationRequestId" : "5", "StockId" : "value pallet", "msgContent" : "Test content" }

As you can see, there is part of this line which is in JSON format.

My need is that I want to extract the value of key "msgContent"

Anyone have an idea about how to do it?

Thank you

Re: How do I extract a value of a key from multi-format data?

493669 — Wed, 10 Oct 2018 13:02:54 GMT

try regex to extract msgContent-

|rex "msgContent\"\s:\s\"(?<msgContent>[^\"]+)"

try this run anywhere search-

|makeresults|eval _raw="08-Oct-2018 16:27:46.6300000|I|CompanyService|MsgReceivePooling OperationRequestMsg [Id(5976) .Net(14)]|App|Company|Algorithm|Treshold||{ \"OperationRequestId\" : \"5\", \"StockId\" : \"value pallet\", \"msgContent\" : \"Test content\" }"|rex "msgContent\"\s:\s\"(?<msgContent>[^\"]+)"

Re: How do I extract a value of a key from multi-format data?

issbouzidi — Wed, 10 Oct 2018 14:02:36 GMT

thank a lot @493669 , the regex works good 🙂