Getting Data In

How to breakdown JSON data with escape characters from events

pkol
Explorer

Hey all,
I have recently structured and extracted some data from a REST API and stored the data in an index. Now the problem is, I have one field in this data which was extracted as its original JSON structure from the API and now it looks like this in one of my events:

threshold_values="{\"thresholdLevels\": [{\"severityValue\": 4, \"severityLabel\": \"medium\", \"severityColor\": \"#FCB64E\", \"severityColorLight\": \"#FEE6C1\", \"thresholdValue\": 0, \"dynamicParam\": 0}, {\"severityValue\": 3, \"severityLabel\": \"low\", \"severityColor\": \"#FFE98C\", \"severityColorLight\": \"#FFF4C5\", \"thresholdValue\": 5, \"dynamicParam\": 0}, {\"severityValue\": 2, \"severityLabel\": \"normal\", \"severityColor\": \"#99D18B\", \"severityColorLight\": \"#DCEFD7\", \"thresholdValue\": 19, \"dynamicParam\": 0}], \"baseSeverityColorLight\": \"#E3F0F6\", \"baseSeverityColor\": \"#AED3E5\", \"gaugeMin\": 0, \"renderBoundaryMin\": 0, \"isMaxStatic\": false, \"baseSeverityValue\": 1, \"metricField\": \"count\", \"isMinStatic\": true, \"gaugeMax\": 20.9, \"baseSeverityLabel\": \"info\", \"renderBoundaryMax\": 100}"

Now my objective is to break down this field into multiple fields of SeverityLabel and SeverityValue and extract their corresponding values. This should be done for all of my events which follow a similar structure.

Please help I am new to Splunk
Thank you.

0 Karma

Sukisen1981
Champion

try this:

|rex field=_raw "severityValue\\\+\"+\:(?<sev_val>.*?)\,+\s+\\\+\"+severityLabel\\\+\"+\:+\s+\\\+\"+(?<sev_label>.*?)\\\+" max_match=0
0 Karma

Sukisen1981
Champion

hi @pkol - Did this resolve your issue?

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...