Getting Data In

How to breakdown JSON data with escape characters from events


Hey all,
I have recently structured and extracted some data from a REST API and stored the data in an index. Now the problem is, I have one field in this data which was extracted as its original JSON structure from the API and now it looks like this in one of my events:

threshold_values="{\"thresholdLevels\": [{\"severityValue\": 4, \"severityLabel\": \"medium\", \"severityColor\": \"#FCB64E\", \"severityColorLight\": \"#FEE6C1\", \"thresholdValue\": 0, \"dynamicParam\": 0}, {\"severityValue\": 3, \"severityLabel\": \"low\", \"severityColor\": \"#FFE98C\", \"severityColorLight\": \"#FFF4C5\", \"thresholdValue\": 5, \"dynamicParam\": 0}, {\"severityValue\": 2, \"severityLabel\": \"normal\", \"severityColor\": \"#99D18B\", \"severityColorLight\": \"#DCEFD7\", \"thresholdValue\": 19, \"dynamicParam\": 0}], \"baseSeverityColorLight\": \"#E3F0F6\", \"baseSeverityColor\": \"#AED3E5\", \"gaugeMin\": 0, \"renderBoundaryMin\": 0, \"isMaxStatic\": false, \"baseSeverityValue\": 1, \"metricField\": \"count\", \"isMinStatic\": true, \"gaugeMax\": 20.9, \"baseSeverityLabel\": \"info\", \"renderBoundaryMax\": 100}"

Now my objective is to break down this field into multiple fields of SeverityLabel and SeverityValue and extract their corresponding values. This should be done for all of my events which follow a similar structure.

Please help I am new to Splunk
Thank you.

0 Karma


try this:

|rex field=_raw "severityValue\\\+\"+\:(?<sev_val>.*?)\,+\s+\\\+\"+severityLabel\\\+\"+\:+\s+\\\+\"+(?<sev_label>.*?)\\\+" max_match=0
0 Karma


hi @pkol - Did this resolve your issue?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!