Extracting JSON from POST data

[dpadams]

I've got log data that includes JSON text that's sent up using POST to a Web server. A raw regex pattern to match the JSON data is:

\{([^}]*)\}

That gets me the curly braces and everything inside. Perfect. Unfortunately, I've been unable to figure out how to adapt this to field extraction system's patterns. I've not managed to get Splunk to recognize my POSTed JSON data using the interactive field extraction screen, which is why I'm trying to get the raw regex into place.

Thanks very much for any assistance.

[dpadams · Accepted solution]

After some completely undignified trial-and-error with a simpler sample set, I've got a pattern that works in Splunk:

(?i)^(?:[^"]*"){3}(?P[^"]+)

This captures the {any contents} and not the double-quotes around the outside. For example, starting from the text below:

"{'user_id':'abc123','action':'add','names':['hello','world']}"

the pattern should match

{'user_id':'abc123','action':'add','names':['hello','world']}

Depending on your your whitespace is organized, the above pattern may need a tweak or two.