Getting Data In

How to extract sub-element data from a JSON message: In the event below, i want to extract from MessageBody, the subdata under Request like businessId, partnerEBID and also some fields from the Response section like branchCode

besa0903
New Member

{

cid: abcde

d: 1211

environment: nonProd

log: request

messageBody:

}

0 Karma
1 Solution

FeatureCreeep
Path Finder

This should be a straight forward regular expression extract. Some of the formatting of your JSON looks strange though, with strange characters in it like where the "∂" where I think you expected "partnerEBID" to be. I also don't see a branchCode but I do see a brandCode. I'm not a JSON expert but that value for the brandCode doesn't look like valid JSON to me. If the value is supposed to be an empty string, it should be 2 sets of double quotes, not just 1. Anyway, with the data provided, I created a very simple regular expression. I'm sure there are better ways to write it but this is the easiest thing that works. I think you can extrapolate from here to extract more fields with this expression.

| rex field=_raw "businessId=(?P<businessId>\d+).*EBID=(?P<partnerEBID>\d+)"

View solution in original post

0 Karma

FeatureCreeep
Path Finder

This should be a straight forward regular expression extract. Some of the formatting of your JSON looks strange though, with strange characters in it like where the "∂" where I think you expected "partnerEBID" to be. I also don't see a branchCode but I do see a brandCode. I'm not a JSON expert but that value for the brandCode doesn't look like valid JSON to me. If the value is supposed to be an empty string, it should be 2 sets of double quotes, not just 1. Anyway, with the data provided, I created a very simple regular expression. I'm sure there are better ways to write it but this is the easiest thing that works. I think you can extrapolate from here to extract more fields with this expression.

| rex field=_raw "businessId=(?P<businessId>\d+).*EBID=(?P<partnerEBID>\d+)"
0 Karma

besa0903
New Member

Great, thanks a bunch. It works like a charm.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...