topic Re: regex question in Splunk Search

regex question

dbautist — Fri, 15 Feb 2013 15:05:21 GMT

I have the following log snippet with a JSON payload that includes a newline. How do I extract the entire JSON payload?

ID: 123
Payload: {
"info":{
"name":"bob",
"age":"35"
}
}

Expected field should contain:

{
"info":{
"name":"bob",
"age":"35"
}
}

Re: regex question

aholzer — Fri, 15 Feb 2013 15:22:49 GMT

This should do the trick for you:

Payload: (?P<YourField>[^\}]+\}){2}

Assuming that all your payloads only have 2 close curly brackets '}'

Use the "interactive field extractor" view to test the regex before applying it (run your search > click the blue box next to one of the events > select "Extract Fields")

EDIT:

Change the value {2} from my above code to match the number of "closing curly brackets" '}' in your payload to have the regex work.

Re: regex question

dbautist — Fri, 15 Feb 2013 15:28:26 GMT

That's actually not the case. I have something like:

{
"test":{
"a":"b"
"c":{
"d":"e"
}
}
"e":{
"f":"g"
}
}

Re: regex question

aholzer — Fri, 15 Feb 2013 15:35:19 GMT

As long as the number of "closing curly brackets" '}' is consistent across all your payloads, just count them and then change the {2} from my original post to the new number.

So in your latest example the {2} should be changed to a {4}.