one of my field is json, how can I extract corretly{

[efrenette11]

Maybe an easy one here.

Here's the log line that I have.

Splun extract by himself unkwnownProperties={

How can I extract the field to be = {"venue":{"unknownProties":true},"common":{"publicVisklklibility":{"startDateTime":"2015-10-29T15:00:00Z","dateTBD":false,"visible":true},"isTpppest":true},"start":{"unknownProties":true}}

2015-11-20T05:27:17.760429-08:00 app1.coco.jetdev2.syseng.tmcs coco: severity="INFO" host="" service_version="" client_host="" client_version="" Correlation-ID="20151120012721" client_rid="" rid="" sid="" thread="http-nio-8080-exec-7" category="com.ticketmaster.platform.bam.strategies.AuditBAMStrategy" datetime="2015-11-20T13:27:17.759Z" bam="audit" appCode="" activity="ingestion" seq="101" ingestion.entity="Event" status="SuccessWarning" code="" detail="Missing and/or unknown properties." missingProperties="{}" unkwnownProperties="{"venue":{"unknownProties":true},"common":{"publicVisklklibility":{"startDateTime":"2015-10-29T15:00:00Z","dateTBD":false,"visible":true},"isTpppest":true},"start":{"unknownProties":true}}"

[jkat54]

I'm borrowing regex from the CEF app here. You should be able to use this in the field extractor app or within your props & transforms.

 (?<=unkwnownProperties=)(.*?(?=(?:\s[\w.:\[\]]+=|$)))

note that unkwnown is spelled wrong. It should be unknown but you provided incorrect spelling in your example.

[somesoni2]

This is generally difficult to extract unless the position of the field is fixed. If the position of field unknownProperties field is fixed (as in the last element as shown in your example, try something like this

your base search | rex field=_raw "\sunknownProperties=(?<unknownProperties>.*)$"

[jsven7]

It's not clear to me what you want to extract from the events.

[woodcock]

Check your typos, fix/normalize your strings and explain in more detail.