topic How to extract values inside of the {}? in Splunk Search

How to extract values inside of the {}?

napoleon182 — Thu, 20 Oct 2022 17:51:23 GMT

Hello Splunk Ninjas!

I will require your assistance with designing my regex expression.

I need to filter for the value of Message in this sample log line:

2022-09-23T13:20:25.765+01:00 [29] WARN Core.ErrorResponse - {} - Error message being sent to user with Http Status code: BadRequest: {"Details":{"field1":value,"field2":"value2"},"Message":"This is the message.","UserMessage":null,"Code":86,"Explanation":null,"Resolution":null,"Category":4}

I will be interested in extracting value of field1, field2 (inside of {Details}, message and code,

Any help, much appreciated!

Thanks again

Re: Help with Regex to extract values inside of the {}

gcusello — Thu, 20 Oct 2022 15:18:03 GMT

i @napoleon182,

this seems to be a json format, did you tried with spath command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath)?

Ciao.

Giuseppe

Re: Help with Regex to extract values inside of the {}

richgalloway — Thu, 20 Oct 2022 15:23:54 GMT

This is fairly simple, but I suspect you are struggling to extract all fields with a single regex. Don't worry about that. Using multiple rex commands is much easier and has little performance penalty. A complex regex that extracts all fields in one go may be less performant.

| rex "Message\\\":\\\"(?<Message>[^\\\"]+)" | rex "field1\\\":\\\"(?<field1>[^\\\"]+)" | rex "field2\\\":\\\"(?<field2>[^\\\"]+)" | rex "Code\\\":(?<Code>\d+)"