topic Re: extract values from a json like string in Splunk Search

How to extract values from a JSON like string?

kotig — Mon, 06 Jul 2020 19:25:09 GMT

I am having data like this in my Splunk and I wanted to extract the value of status which is Active.

How can I do it when this is not a valid JSON string?

mydata { name { value: "1111" } id { value: "2020-07-02 15:49:00" } status { value: "Active" } } Any help is appreciated.

Re: extract values from a json like string

richgalloway — Mon, 06 Jul 2020 18:06:07 GMT

Assuming that's all one event, then rex should do the job.

... | rex "status \{\nvalue: \"(?<status>\w+)"

Re: extract values from a json like string

kotig — Mon, 06 Jul 2020 19:31:40 GMT

yea i tried the rex. But it did not work. What i did was search splunk and put them into a table and then tried the rex as mentioned above but i had no luck.

Re: extract values from a json like string

richgalloway — Mon, 06 Jul 2020 20:24:59 GMT

Please elaborate. What search did you use? What does the table look like? What rex did you try?

Re: extract values from a json like string

kotig — Tue, 07 Jul 2020 00:39:23 GMT

index=mysearchIndex | table message | rex "status \{\nvalue: \"(?<status>\w+)" | table status

Here - message contains contains the string like below:

message

-----------

mydata {
name {
value: "1111"
}
id {
value: "2020-07-02 15:49:00"
}
status {
value: "Active"
}
}

Re: extract values from a json like string

bowesmana — Tue, 07 Jul 2020 00:50:35 GMT

@kotig You are not specifying field=message in the rex command, so it is looking at _raw which no longer exists after your table message statement

| makeresults | eval message="mydata { name { value: \"1111\" } id { value: \"2020-07-02 15:49:00\" } status { value: \"Active\" } }" | rex field=message "status \{\nvalue: \"(?<status>\w+)" | table status

Re: extract values from a json like string

kotig — Tue, 07 Jul 2020 01:05:15 GMT

Thank you @richgalloway and @bowesmana . That worked.