How to extract fields from child node

michael_wong — Fri, 21 Jun 2024 08:17:50 GMT

Deleted

Re: How to extract fields from child node

venkatasri — Mon, 01 Mar 2021 23:19:51 GMT

Hi,

Splunk extracts the JSON fields automatically if it is well-formed. In this case json fields are starting with leading _ which will be removed by Splunk when automatically extract the fields.

Your fields would be,

content_

hostname_

etc..

You can use inline regex as following to extract KV pairs in content_ field .

index=test source="test_json" sourcetype="test_new"
| rex field=content_ "TTY=(?<tty_val>[^;]+);\s+PWD=(?<pwd_val>[^;]+);\s+USER=(?<user_val>[^;]+);\s+COMMAND=(?<command_val>[^;]+)"
| table tty_val pwd_val user_val command_val

Please note in your case source index and sourcetype differs.

--------------------------------

upvote if it helps!

topic Re: How to extract fields from child node in Getting Data In

How to extract fields from child node

Re: How to extract fields from child node