topic Re: How extract specific value ? in Splunk Search

How extract specific value ?

Jean-Sébastien — Thu, 02 Jan 2025 09:41:30 GMT

Hello,

I have big and complete log and want to extract specific value.

Small part of log: "state":{"running":{"startedAt":"2024-12-19T13:58:14Z"}}}],

I would like to extract running in this case, value can be other .

Could you please help me ?

Re: How extract specific value ?

kiran_panchavat — Thu, 02 Jan 2025 09:59:50 GMT

Hello @Jean-Sébastien

You can use regex. This will create a new field called output that contains the values running, drinking, and walking. Let me know if you need more assistance!

Re: How extract specific value ?

kiran_panchavat — Thu, 02 Jan 2025 10:01:25 GMT

@Jean-Sébastien

You can use rex command. The rex command matches the value of the specified field against the unanchored regular expression and extracts the named groups into fields of the corresponding names.

https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/Rex

Re: How extract specific value ?

ITWhisperer — Thu, 02 Jan 2025 11:36:02 GMT

This looks like it might be JSON. Have you looked at the json functions?

Re: How extract specific value ?

yuanliu — Fri, 03 Jan 2025 22:39:55 GMT

It is best not to use rex to extract information from structured data. As @ITWhisperer says, the OP should post complete sample logs instead of a fragment of JSON. If the raw event is itself compliant JSON, there should be no need to extract using search commands because Splunk automatically does this at search time.