Getting Data In

How to breakdown JSON data with escape characters from events

pkol
Explorer

Hey all,
I have recently structured and extracted some data from a REST API and stored the data in an index. Now the problem is, I have one field in this data which was extracted as its original JSON structure from the API and now it looks like this in one of my events:

threshold_values="{\"thresholdLevels\": [{\"severityValue\": 4, \"severityLabel\": \"medium\", \"severityColor\": \"#FCB64E\", \"severityColorLight\": \"#FEE6C1\", \"thresholdValue\": 0, \"dynamicParam\": 0}, {\"severityValue\": 3, \"severityLabel\": \"low\", \"severityColor\": \"#FFE98C\", \"severityColorLight\": \"#FFF4C5\", \"thresholdValue\": 5, \"dynamicParam\": 0}, {\"severityValue\": 2, \"severityLabel\": \"normal\", \"severityColor\": \"#99D18B\", \"severityColorLight\": \"#DCEFD7\", \"thresholdValue\": 19, \"dynamicParam\": 0}], \"baseSeverityColorLight\": \"#E3F0F6\", \"baseSeverityColor\": \"#AED3E5\", \"gaugeMin\": 0, \"renderBoundaryMin\": 0, \"isMaxStatic\": false, \"baseSeverityValue\": 1, \"metricField\": \"count\", \"isMinStatic\": true, \"gaugeMax\": 20.9, \"baseSeverityLabel\": \"info\", \"renderBoundaryMax\": 100}"

Now my objective is to break down this field into multiple fields of SeverityLabel and SeverityValue and extract their corresponding values. This should be done for all of my events which follow a similar structure.

Please help I am new to Splunk
Thank you.

0 Karma

Sukisen1981
Champion

try this:

|rex field=_raw "severityValue\\\+\"+\:(?<sev_val>.*?)\,+\s+\\\+\"+severityLabel\\\+\"+\:+\s+\\\+\"+(?<sev_label>.*?)\\\+" max_match=0
0 Karma

Sukisen1981
Champion

hi @pkol - Did this resolve your issue?

0 Karma
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...