extract message field from JSON

Esky73 — Tue, 10 Jul 2018 07:41:15 GMT

trying to extract the msg field from an azure blob which uses the _json sourcetype - the msg : field shows as one long field - how to extract this please ?

msg: 2018-07-10T06:53:42.803Z email|5b3c37d::Rules::ValidateUser:: ::BEGIN-RULE:: Validate - user {"_id":"25fd57973c","email":"blah@hotmail.com","email_verified":true,"clientID":"8NReZXmds4","updated_at":"2018-07-10T06:53:42.764Z","name":"blah@hotmail.com","picture":"https://web.png","user_id":"email|5b3c37dd","nickname":"nickname","identities":[{"user_id":"5b3c3","provider":"email","connection":"email","isSocial":false}],"created_at":"2018-07-04T02:58:55.014Z","user_metadata":{"firstname":"bob","lastname":"bob","name":"bob bob"},"global_client_id":"rEJsAkwGVI","app_metadata":{"client_info":{"MyAccount":{"first_login_time":"2018-07-04T02:58:55.422Z","count":7,"last_login_time":"2018-07-10T06:49:40.126Z","user_id":"a0uid_xxxxx"}}},"client_info":{"MyAccount":{"first_login_time":"2018-07-04T02:58:55.422Z","count":7,"last_login_time":"2018-07-10T06:49:40.126Z","user_id":"a0uid_46"}},"persistent":{}}

thanks

*** UPDATE ***

So i've made some progress where i can create a new_msg field stripping off the non-json part of the msg field :

2018-07-10T06:53:42.803Z email|5b3c37d::Rules::ValidateUser:: ::BEGIN-RULE::Validate - user

and then that allows me to run spath on the new_msg

| rex field=msg "^[^{]+(?<new_msg>.*)" | spath input=new_msg

now my field count has gone from ~50 to 500+

Is there a better way ?

Re: extract message field from JSON

manish_singh_77 — Tue, 10 Jul 2018 09:56:11 GMT

Pls try this in your search and let me know..

extract pairdelim=",", kvdelim='":"'

Re: extract message field from JSON

manish_singh_77 — Tue, 10 Jul 2018 10:26:03 GMT

You can also use the below mentioned regex, there are two regex, one captures everything after msg and other captures only till email, try this and let me know if it works for you.

yourBaseQuery
|rex "\msg:\s+(?.*)"
| complete your search

yourBaseQuery
| rex \msg:\s+(?\w+-\w+-\w+:\w+:\w+.\w+\s+\w+)
| complete your search

Re: extract message field from JSON

Esky73 — Tue, 10 Jul 2018 12:55:00 GMT

both of these errored with Regex: unrecognized character follows \

I have updated my progress above. TY

topic Re: extract message field from JSON in Splunk Search

extract message field from JSON

Re: extract message field from JSON

Re: extract message field from JSON

Re: extract message field from JSON