field extraction

msachdeva3 — Sun, 29 Jan 2017 20:15:33 GMT

I have a data in the format

index = abc earliest =-10d when i run get results in teh format of string
result set events
data: {"Ts":1485478049000,"Off":-6,"Term":"ABCD1234","Msg":"ABCDSDfaafafsomestring value","Ip":"someipnumber"}

I want to extract values of Termm,Msg, &ip value

I have tried using field extraction but having issues I want to get through regex or rex, Can you pls let me know how can i get values into fields like ip, Msg & Term

Thanks

Re: field extraction

gokadroid — Sun, 29 Jan 2017 20:36:07 GMT

If its json then it shall already be extracted, but if not already extracted then you can extract them using below regex which will extract the values in fields called termField, msgField, ipField :

your query to return events
| rex field=_raw "Term\"\s*:\s*\"(?<termField>[^\"]+)\",\"Msg\"\s*:\s*\"(?<msgField>[^\"]+)\",\"Ip\"\s*:\s*\"(?<ipField>[^\"]+)\""
| table termField, msgField, ipField

You can change the names of these fields if you like by changing it in above regex and same regex can be used in field extractor.

topic field extraction in Splunk Search

field extraction

Re: field extraction