Request={"headers":{"zip":"500000"}},"location":"HYD","info":[{"phoneNumber":"******6467","test":[{"id":"1234"}]}],"testing123":{"tenure":1234,"stringvalue":"A"}}}
How can search for "stringvalue":"A"?
I tried | makemv tokenizer="([^,]+)," Params | mvexpand line
| rex field=Params "(?<key>[^{'stringvalue'':']+) : (?<value>[A]+)" It did not work.
Hi @ashukp,
do you want to search or to extract field?
if you want to search you can use the regex command:
| makeresults
| eval _raw="Request\=\{\"headers\":\{\"zip\":\"500000\"\}\},\"location\":\"HYD\",\"info\":\[\{\"phoneNumber\":\"******6467\",\"test\":\[\{\"id\":\"1234\"\}\]\}\],\"testing123\":\{\"tenure\":1234,\"stringvalue\":\"A\"\}\}\}"
| regex "\"stringvalue\":\"[^\"]+\""
if instead you want to extarct the value after "stringvalue", you have to use the rex command:
| makeresults
| eval _raw="Request\=\{\"headers\":\{\"zip\":\"500000\"\}\},\"location\":\"HYD\",\"info\":\[\{\"phoneNumber\":\"******6467\",\"test\":\[\{\"id\":\"1234\"\}\]\}\],\"testing123\":\{\"tenure\":1234,\"stringvalue\":\"A\"\}\}\}"
| rex "\"stringvalue\":\"(?<stringvalue>[^\"]+)\""
Ciao.
Giuseppe