Can you help me get multiple fields from a single field in JSON?

[danw25]

The text field in my event contains A LOT of data.

json snipped :

{"Date":"2018-12-05T12:04:04.71","ID":"00000000-0000-0000-0000-000000000000","Text":"*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***} 

What i'm trying to do is write a search that will get all values of on/all fields.

i.e. "get all values of userCount"

i have had some progress using eval and split

eval values=split(Text," * ") |
eval temp=mvindex(values,0)|
eval temp=split(temp,"=")|eval temp=mvindex(temp,1)|convert rmunit(temp)|    
eval normalSliceUsage=temp| table Date normalSliceUsage

[sdchakraborty]

Hi,

Can you try the below search, the idea is to create those fields using rex.

index=<your index>
|  rex field=Text normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)

you can checkout the how the rex working in the below site,

https://regex101.com/

in the test string give the below,

*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***

in the regex give the below regex,

 normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)

[prakash007]

I guess Splunk should auto-extract field values when they are in foo=bar format, check your interesting fields for userCount, if not pls post a snippet of your json data.

[whrg]

Does one event in Splunk contain multiple lines of text or only one line?
When you search for your events in Splunk, is the field "userCount" available on the left side?