How to extract fields from child node

[michael_wong]

Deleted

[venkatasri · Accepted solution]

Hi,

Splunk extracts the JSON fields automatically if it is well-formed.  In this case json fields are starting with leading _ which will be removed by Splunk when automatically extract the fields.

Your fields would be,

content_

hostname_

etc..

You can use inline regex as following to extract KV pairs in content_ field .

index=test source="test_json"  sourcetype="test_new"
| rex field=content_ "TTY=(?<tty_val>[^;]+);\s+PWD=(?<pwd_val>[^;]+);\s+USER=(?<user_val>[^;]+);\s+COMMAND=(?<command_val>[^;]+)"
| table tty_val pwd_val user_val command_val

Please note in your case source index and sourcetype differs.

--------------------------------

upvote if it helps!