Extract fields from json and nested json

[gemrose]

I am using regex to extract the field from the below json data. I want to extract the fields in key-value pair specially log.message from the json data. Example if I need "action" field from log.message

clusterName: cluster-9gokdwng4f
internal_tag: internal_security
log: { [-]
message: {"action":"EXECUTE","class":"System-Queue","eventC":"Data access event","eventT":"Obj-Open with role","timeStamp":"Wed 2024 Apr 03, 04:58:28:932"}
stack:
thread_name: Batch-1
timestamp: 2024-04-03T04:58:28.932Z
version: 1
}
}

[PickleRick]

1. Don't use simple regexes to manipulate structured data. Earlier or later you'll regret it (you'll get yourself in a situation with some (un)escaped delimiter or similar thing).

2. This is not a well-formed json.

3. Splunk doesn't handle well json (or any other structured data like XML) with additional content "surrounding" it in terms of automatic extraction so your best bet would be to extract the json part (with caution - see point 1) and run spath command on that field. Unfortunately it cannot be made as automatic extraction. It needs to be invoked manually in your search pipeline.

[gemrose]

I used spath for extraction