topic Re: Splunk query to extract json key value in Splunk Search

Splunk query to extract json key value

sahuask — Tue, 08 Feb 2022 04:30:12 GMT

Please help to extract payload data from logs entries and extract the PlatformVersion and PlatformClient values. Need in python code.

Log Entries:

"tracking~2015~526F3D98","2015:1302",164,1,"2022-02-07 11:10:08.744 INFO [threadPoolTaskExecutorTransformed5 - ?] saving event to log =core-server-event-tracking-api, payload={""PlatformVersion"":""6.34.36 - 4.18.6"",""PlatformClient"":""html""},53
"tracking~2015~526F3D98","2015:130",164423,1,"2022-02-07 11:10:08.744 INFO [threadPoolTaskExecutorTransformed5 - ?] saving event to log =core-server-event-tracking-api, payload={""PlatformVersion"":""6.34.37 - 4.18.7"",""PlatformClient"":""xml""},54

Thanks

Re: Splunk query to extract json key value

venkatasri — Tue, 08 Feb 2022 06:00:04 GMT

Hi @sahuask

You shall be bit more specific, the SH automatically extract the JSON fields automatically if props.conf having correct settings.

What you mentioned was about python code, meaning how you going to read the data in python code?
probably API?

Re: Splunk query to extract json key value

sahuask — Tue, 08 Feb 2022 06:06:32 GMT

I dont have the control for the configuration setting. the ask is to extract from the log entries as text.

Yes, I need a to use splunk api in python code.

Re: Splunk query to extract json key value

johnhuang — Tue, 08 Feb 2022 10:35:44 GMT

Regex:

payload\=\{\"+PlatformVersion[\"\:]*(?<platform_ver>[^\"]*)[\"\,"]*(?<platform_client>[^\"]*)\"

Re: Splunk query to extract json key value

sahuask — Tue, 08 Feb 2022 14:56:52 GMT

Thanks @johnhuang .

I am using python and im getting error- Mismatched ']'.

Can you please provide me the python version of this regex. Thanks