Splunk Search

Extract user field from log?

user9025
Path Finder

I have a log which looks like follow:

 

Request received :: Id assigned. --- Id=1,  BODY={"userIds":["11"],"email":"test@test.com,"Client":"Test"} 

 

The userids will always contains one element in the list surrounded by square brackets. So from above request I want to get 11. I am using rex to extract userID but seems that its not working.

 

index=prod-* sourcetype="kube:service"  "Request received " | rex field=_raw "userIds\":\[\"(?<user_id>\d+)\"" |table user_id

 

But table is getting printed empty

Labels (1)
Tags (1)
0 Karma

user9025
Path Finder

do we need to extract json variable BODY first from logs and then do it?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

In a way yes, because you should not try to manage structured data like JSON using pure text manipulation like rex.  On the other hand, if your data source is configured normally, you should already have a field named BODY. If not, you can use kv aka extract.

Once you verify that BODY is extracted, use spath to extract structured fields.

 

| spath input=BODY

 

0 Karma

user9025
Path Finder

the events shared are reals, with some fields obfuscated, I am able to extract events, but putting them in table is coming up empty

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There doesn't appear to be anything wrong with what you are doing given the example you have shared. Perhaps the example doesn't accurately represent your actual data? Can you share some obfuscated real events?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...