Getting Data In

How to extract json from event with = separated values?

zachsisinst
Explorer

 

Hello, I have the following type of event, and I would like to extract the `tags` field into its respective fields. 

 

2022-10-17 06:50:00.997, root_device_name="/dev/sda1", root_device_type="ebs",  state_name="running", subnet_id="subnet-REDACTED", tags="{"App": "myapp", "Name": "myserver", "Owner": "myteam", "Scope": "myscope", "AWSBackup": "True", "Environment": "myenv", "Compliance requirement": "N/A"}", virtualization_type="hvm",  vpc_id="vpc-REDACTED"

 



I have tried the following which did not work for me: 

 

index=myindex sourcetype=mysourcetype earliest=@d i-REDACTED source=awsec2instances
| spath input=tags 

 

How do I extract these JSON fields from an event like this? 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex "tags=\"(?<tags>\{[^\}]+\})"
| spath input=tags
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...