topic Re: How to use rex to extract JSON text in "msg" keyValue pair? in Splunk Search

How to use rex to extract JSON text in "msg" keyValue pair?

kabSplunk — Sat, 22 Oct 2016 03:03:57 GMT

I have a json raw string from which I have to extract the "msg" key and pair value. Can you please assist. The log line looks like below:

<6>2015-11-26T17:00:15Z x45678fnjotq5 doe[88]: {"ddcfa_app_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsa","ddcfa_app_name":"paymentManagementApplication","ddcfa_org_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsasdas63g3664-s35d-33sfa","ddcfa_space_name":"noShowMessage","event_type":"LogMessage","level":"info","message_type":"OUT","msg":"DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()","origin":"rep","source_instance":"0","source_type":"APP","time":"2015-11-26T17:00:15Z","timestamp":1477069200012312311}

I want to extract "msg" field's "value":

DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()

Re: How to use rex to extract JSON text in "msg" keyValue pair?

adayton20 — Sat, 22 Oct 2016 15:18:28 GMT

Is this what you're looking for?

 ... | rex field=_raw "msg\":\"(?P<msg>.[^\"\,\"]*)" | table msg

Appears to work for me:

Re: How to use rex to extract JSON text in "msg" keyValue pair?

gokadroid — Sat, 22 Oct 2016 15:55:18 GMT

yourBaseQuery
|rex ".*,\"msg\":\"(?<message>.*)\",\"origin\""
| complete yourSearch

Re: How to use rex to extract JSON text in "msg" keyValue pair?

gokadroid — Thu, 11 Mar 2021 03:20:41 GMT

Adding this for reference @bsrikanthreddy5

`|eval nowstring=strftime(now(), "%Y-%m-%d")`

Re: How to use rex to extract JSON text in "msg" keyValue pair?

vaizpatu — Fri, 05 Aug 2022 13:59:34 GMT

.*"msg":"(?P<message>[^="]+).*