Can't extract fields and make list?

[Renunaren]

Hi Team,

Please help us on the below issue. Below is the sample event.

message: Dataframe row : {"_c0":{"0":"{","1":"    \"compaction_table\": [","2":"        \"md_proc_control_v2\"","3":"        \"md_source_control\"","4":"    ]","5":"    \"Timestamp\": \"2023\/06\/26 12:05:43\"","6":"    \"compaction_status\": \"Successful\"","7":"}"}} 

In the above message, we have an event with the compaction_table, timestamp and compaction_status. We have tried to extract the files for compaction table such as md_proc_control_v2, md_source_control  as a separate field by name List using the below SPL query.

index="app_events_dwh2_de_int" _raw=*compac* | rex "(?:\"compaction_table[\\\\]+\": \[)(?<compactionlist>[^\s:]+[^\]]+)"
| rex field=compactionlist max_match=0 "(?:[^\s:]+[^\s]+\s[\\\\]+)(?<List>[^\\\]+)

But we are unable to extract those files using the above SPL query. We have extracted the compactionlist field like below.

But we are unable to extract the List from the field compactionlist.

We request you to kindly help us in extraction of the files md_proc_control_v2, md_source_control as separate field by name List and also the compaction status as a separate field and also the Timestamp as a separate field from the event. Below is the sample raw text for this.

Dataframe row : {"_c0":{"0":"{","1":"    \"compaction_table\": [","2":"        \"md_proc_control_v2\"","3":"        \"md_source_control\"","4":"    ]","5":"    \"Timestamp\": \"2023\/06\/26 12:05:43\"","6":"    \"compaction_status\": \"Successful\"","7":"}"}} 

[splunkjas1]

Woah, that data is wonky. I'd probably do something like this:

| makeresults
| eval _raw="message: Dataframe row : {\"_c0\":{\"0\":\"{\",\"1\":\" \\\"compaction_table\\\": [\",\"2\":\" \\\"md_proc_control_v2\\\"\",\"3\":\" \\\"md_source_control\\\"\",\"4\":\" ]\",\"5\":\" \\\"Timestamp\\\": \\\"2023\/06\/26 12:05:43\\\"\",\"6\":\" \\\"compaction_status\\\": \\\"Successful\\\"\",\"7\":\"}\"}}"
| rex field=_raw mode=sed "s/\s|{|}|\"|\\\//g"
| eval parts=split(_raw, ",")
| fields parts

That gives me something a bit more sane to deal with:

 

I could deal with that then. Just trying to help you get there. 🙂

[Renunaren]

We already tried this but this doesn't worked, is there any other way to extract them as a separate fields.