topic Re: How to extract json values in Splunk Search

How to extract json values

tsm0099 — Tue, 27 Oct 2020 08:10:48 GMT

I have an event in json which has key pairs like:

{

"timestamp": 157281937,

"message":"abc\xyz\pqr\efg",

}

I have to create a table of message with with four columns and the columns in the table will have the values abc,xyz,qpr,efg...

How can i do this?

Thanks in advance!

Re: How to extract json values

ITWhisperer — Tue, 27 Oct 2020 10:23:13 GMT

| spath message | rex field=message "(?<col1>[^\\\]+)\\\(?<col2>[^\\\]+)\\\(?<col3>[^\\\]+)\\\(?<col4>.+)" | table col1 col2 col3 col4

Re: How to extract json values

tsm0099 — Tue, 27 Oct 2020 09:17:31 GMT

Throws an error...

Regex: missing terminating for character class.

Re: How to extract json values

ITWhisperer — Tue, 27 Oct 2020 09:26:47 GMT

Try your data and the rex expression at regex101.com to see where the error is coming from.

How to extract json values

tsm0099 — Tue, 27 Oct 2020 09:59:18 GMT

It works fine in regex101...

But when i use it in splunk search it throws the error:

Encountered the following error while compiling the regex '(?<col1>[^\]+)\(?<col2>[^\]+)\(?<col3>[^\]+)\(?<col4>.+)'

Note: in the error regex i only see single \ instead of \\

Do you have any idea about thia?

Re: How to extract json values

ITWhisperer — Tue, 27 Oct 2020 10:25:42 GMT

You need \\ in regex and \\\ in splunk

| makeresults | eval _raw="abc\\xyz\\pqr\\efg" | rex "(?<col1>[^\\\]+)\\\(?<col2>[^\\\]+)\\\(?<col3>[^\\\]+)\\\(?<col4>.+)"

Re: How to extract json values

to4kawa — Tue, 27 Oct 2020 10:48:55 GMT

index=_internal | head 1 | fields _raw |eval _raw="{ \"timestamp\": 157281937, \"message\":\"abc\xyz\pqr\efg\", }" | rex mode=sed "s/,\s+}/}/g s/\\\/#/g" | spath message | rex field=message "(?<col1>\w+)#(?<col2>\w+)#(?<col3>\w+)#(?<col4>\w+)"

Why don't you change the characters?