Extract Key value data from raw events

[bijodev1]

Hi Team,

I am trying to pull the data for the below raw events.

{"name":"Content-Length","valueList":["94"]}
{"name":"Referer","valueList":["https://www.abc.com/xyz/pageID"]}

The end result I am looking for is :

Content-Length :  94

Referer : /xyz/pageID

I am not sure if this is really possible to pull make a value to a key pair.  Still trying to understand the regex but no luck. if someone could please give a hint or help on how to work with this.

[kamlesh_vaghela]

@bijodev1 

Can you please share some sample events with OrderId?

KV

[bijodev1]

@kamlesh_vaghela 

I need to take the count of unique order ID along with result column.

Currently I don't have a sample data with me.

[kamlesh_vaghela]

@bijodev1 

Can you please try this?

| makeresults count=2000 | eval a=1 | accum a
| eval _raw="\"Header\":[{\"name\":\"orderID\",\"valueList\":[\"a".a."\"]},{\"name\":\"Content-Length\",\"valueList\":[\"94\"]},{\"name\":\"Referer\",\"valueList\":[\"https://www.abc.com/xyz/pageID\"]},{\"name\":\"User-Agent\",\"valueList\":[\"Androidv11\"]}." 
| rex field=_raw "\"Header\":\[(?<raw>.*).$" 
| rex field=raw mode=sed "s/},{/}|{/g"
| eval raw=split(raw,"|") |eval a=1 | accum a| mvexpand raw| rename raw  as _raw
| extract | rename valueList{} as value  | eval result=name.": ".value
| eval orderID = if(name="orderID",value,null())
| stats delim="," values(name) as name values(orderID) as orderID by a | nomv name
| table orderID name

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[bijodev1]

@kamlesh_vaghela 

along with the same data. I want to add status code, it is not working. 

The status code is part of raw events but not in "Headers" it is different field with the name status.

*.... | rex field=_raw "\"Headers\":\[(?<raw>.*).$"
| rex field=raw mode=sed "s/},{/}|{/g"
| eval raw=split(raw,"|")| mvexpand raw | rename raw as _raw
| extract | rename valueList{} as value | table name value | eval result=name.": ".value | eval orderID = if(name="OrderID",value,null())
| stats count by orderID status

It is not working for me.

[kamlesh_vaghela]

@bijodev1 

Can you please try this?

YOUR_SEARCH | rename valueList{} as value | table name value | eval result=name.": ".value

My Sample Search :

| makeresults | eval raw="{\"name\":\"Content-Length\",\"valueList\":[\"94\"]}|{\"name\":\"Referer\",\"valueList\":[\"https://www.abc.com/xyz/pageID\"]}",raw=split(raw,"|")| mvexpand raw| rename raw  as _raw | extract | rename valueList{} as value | table name value | eval result=name.": ".value

 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.