Getting Data In

How do I extract a value of a key from multi-format data?

issbouzidi
New Member

Hi,

I'm new in Splunk. I need help with extraction data, and I have a multi-format file. Example:

08-Oct-2018 16:27:46.6300000|I|CompanyService|MsgReceivePooling OperationRequestMsg [Id(5976) .Net(14)]|App|Company|Algorithm|Treshold||{ "OperationRequestId" : "5", "StockId" : "value pallet", "msgContent" : "Test content" }

As you can see, there is part of this line which is in JSON format.

My need is that I want to extract the value of key "msgContent"

Anyone have an idea about how to do it?

Thank you

0 Karma
1 Solution

493669
Super Champion

try regex to extract msgContent-

|rex "msgContent\"\s:\s\"(?<msgContent>[^\"]+)"

try this run anywhere search-

|makeresults|eval _raw="08-Oct-2018 16:27:46.6300000|I|CompanyService|MsgReceivePooling OperationRequestMsg [Id(5976) .Net(14)]|App|Company|Algorithm|Treshold||{ \"OperationRequestId\" : \"5\", \"StockId\" : \"value pallet\", \"msgContent\" : \"Test content\" }"|rex "msgContent\"\s:\s\"(?<msgContent>[^\"]+)"

View solution in original post

0 Karma

493669
Super Champion

try regex to extract msgContent-

|rex "msgContent\"\s:\s\"(?<msgContent>[^\"]+)"

try this run anywhere search-

|makeresults|eval _raw="08-Oct-2018 16:27:46.6300000|I|CompanyService|MsgReceivePooling OperationRequestMsg [Id(5976) .Net(14)]|App|Company|Algorithm|Treshold||{ \"OperationRequestId\" : \"5\", \"StockId\" : \"value pallet\", \"msgContent\" : \"Test content\" }"|rex "msgContent\"\s:\s\"(?<msgContent>[^\"]+)"
0 Karma

issbouzidi
New Member

thank a lot @493669 , the regex works good 🙂

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...