topic Re: parse and index json fields from string message in Splunk Search

parse and index json fields from string message

vashodha — Thu, 18 Feb 2021 16:28:57 GMT

Hello,

I have log in the format

"2021-02-18T16:17:12,189Z [main] INFO logname -streamstart-k1:V1,K2:V2,K3:V3,streamstop, <ADDIITONAL DATA>" i want to parse out json elements k1:v1 etc thats between "-streamstart" and streamstop

Re: parse and index json fields from string message

vashodha — Thu, 18 Feb 2021 16:50:50 GMT

This gives me what i want but i am unable to index it in splunk

(?<=streamstart-).*?(?=streamstop)

Re: parse and index json fields from string message

b4badri — Thu, 18 Feb 2021 19:43:51 GMT

Try this

rex "streamstart(?<myvariable>(.*)(?=streamstop))"

Re: parse and index json fields from string message

vashodha — Thu, 18 Feb 2021 21:41:47 GMT

it does the job but still dosent index the fields its extracted it out to the variable can we somehow index these csv values

Re: parse and index json fields from string message

b4badri — Fri, 19 Feb 2021 06:30:40 GMT

Hi @vashodha

Yes. Data extracted using rex in the search time will only be available for the search. You need to follow series of steps based on your Splunk solution for creating fields at Index time.

Please refer the below article.

Create custom fields at index time - Splunk Documentation