How do I extract a value of a key from multi-format data?

[issbouzidi]

Hi,

I'm new in Splunk. I need help with extraction data, and I have a multi-format file. Example:

08-Oct-2018 16:27:46.6300000|I|CompanyService|MsgReceivePooling OperationRequestMsg [Id(5976) .Net(14)]|App|Company|Algorithm|Treshold||{ "OperationRequestId" : "5", "StockId" : "value pallet", "msgContent" : "Test content" }

As you can see, there is part of this line which is in JSON format.

My need is that I want to extract the value of key "msgContent"

Anyone have an idea about how to do it?

Thank you

[493669 · Accepted solution]

try regex to extract msgContent-

|rex "msgContent\"\s:\s\"(?<msgContent>[^\"]+)"

try this run anywhere search-

|makeresults|eval _raw="08-Oct-2018 16:27:46.6300000|I|CompanyService|MsgReceivePooling OperationRequestMsg [Id(5976) .Net(14)]|App|Company|Algorithm|Treshold||{ \"OperationRequestId\" : \"5\", \"StockId\" : \"value pallet\", \"msgContent\" : \"Test content\" }"|rex "msgContent\"\s:\s\"(?<msgContent>[^\"]+)"

[issbouzidi]

thank a lot @493669 , the regex works good 🙂