topic Re: How to Extract multiple values in field in json in Splunk Search

How to Extract multiple values in field in json

karthi2809 — Mon, 18 Mar 2024 14:48:33 GMT

Thanks

I am trying to extract three fields in below given message

"message" : "BatchId : 7, RequestId : 100532188, Msg : Batch status to be update to SUCCESS",

Extract : BatchId ,RequestId ,Status need to extract SUCCESS .

| rex "BatchId\s*:\s*(?<batch>[^,]+),\s*RequestId\s:\s*(?<RequestID>[^,]+),\s*Msg : Batch status to be update to (?<Status>\w+)"

isoutamo — Mon, 18 Mar 2024 14:06:18 GMT

you could try this

| rex "BatchId\s*:\s*(?<batch>[^,]+),\s*RequestId\s*(?<RequestID>[^,]+),\s*Msg : Batch status to be update to (?<Status>[^,]+)"

If this is in any other field than _raw then add into rex field=<your field name>

r. Ismo