topic split string from a field in Dashboards & Visualizations

split string from a field

sahana — Fri, 01 Oct 2021 09:50:41 GMT

I have a message body text as like below

message : RequestBody : : :{

individualValue : {

xxxxxx;

YYYY;

-----------------------having many txt in between these

}

How can i fetch the string "individualValue" from the message body

ITWhisperer — Fri, 01 Oct 2021 09:56:45 GMT

Do you mean something like this?

| rex "(?<individualValue>individualValue\s:\s\{[^\}]+\})"

sahana — Fri, 01 Oct 2021 10:07:48 GMT

I need to assign this string to a field, something like service=individualValue after splitting

ITWhisperer — Fri, 01 Oct 2021 10:32:25 GMT

Do you mean like this:

| rex "(?<service>individualValue\s:\s\{[^\}]+\})"

The name of the field which rex puts the value into is in the angle brackets <>

Or do you want to split the individual values in the braces {} into a multi-value field?