Dashboards & Visualizations

How to extract the specific key value pair ?

mlevsh
Builder

We have the following data ingested (not json format) , where we are trying to extract 
"DeletedImages": 0 and "DeletedImages": 24 value pairs

Data:

2021-05-04 - 13:50:41.878 - INFO : Action completed in 0.192996025085 seconds, result is {
"images-deleted": 0,
"metrics": {
"Action": "Ec2DeleteImageAction",
"Data": {
"DeletedImages": 0
},
"Version": "1.0",
"Type": "action",
"ActionId": "12345"
},
"account": "123456789",
"task": "ABCD-EFGE-QAQ-DELETE-IMAGE",
"images": 535,
"region": "ab-east-1"
} - ReconNum:123456678901234

2021-05-04 - 13:55:41.878 - INFO : Action completed in 0.192996025085 seconds, result is {
"images-deleted": 0,
"metrics": {
"Action": "Ec2DeleteImageAction",
"Data": {
"DeletedImages": 24
},
"Version": "1.0",
"Type": "action",
"ActionId": "12345"
},
"account": "123456788",
"task": "ABCD-EFGE-QAQ-DELETE-IMAGE",
"images": 536,
"region": "ab-east-1"
} - ReconNum:123456678901235

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use rex with

| rex field=_raw "DeletedImages.:\s(?<DeletedImageCount>\d+)"

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use rex with

| rex field=_raw "DeletedImages.:\s(?<DeletedImageCount>\d+)"

 

mlevsh
Builder

@bowesmana  Thank you! That worked perfectly!

 
 
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Assuming that is two events. If it is a single event and you need to extract both values from it, then modify the rex statement like this

| rex field=_raw max_match=0 "DeletedImages.:\s(?<DeletedImageCount>\d+)"

and you will get a multi value field with the two values

 

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...