Extraction of a field inside Json data

[splunklearner]

Please extract User-Agent field from the below Json event .

httpMessage: { [-]
     bytes: 2
     host: rbwm-api.sony.co.uk
     method: GET
     path: /kong/originations-loans-uk-orchestration-prod-proxy/v24/status
     port: 443
     protocol: HTTP/1.1
     requestHeaders: Content-Type: application/json X-SONY-Locale: en_GB X-SONY-Chnl-CountryCode: GB X-SONY-Chnl-Group-Member: HRFB X-SONY-Channel-Id: WEB Cookie: dspSession=hzxVP-NKKzZIN0wfzk85UD0ji7I.*AAJTSQACMDIAAlNLABxvOTRoWElJS2FEU0wrNlMxdTByMGtGN2JYM289AAR0eXBlAANDVFMAAlMxAAI0NQ..* Accept: */* User-Agent: node-fetch/1.0 ( https://github.com/bitn/node-fetch) Accept-Encoding: gzip,deflate Host: rbwm-api.sony.co.uk Connection: close remove-dup-edge-ctrl-headers-rollout-enabled: 1

httpMessage.requestHeaders field values are extracting but only want User-Agent field and values to be extracted from all values. Please help me with this.

[splunklearner]

thanks

[livehybrid]

Hi @splunklearner 

Try the following:

| rex field=requestHeaders "User-Agent: (?<useragent>.*?)(?=\s+\w+-?[\w-]*: )"

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[richgalloway]

What have you tried so far?  What were the results?

[splunklearner]

I used spath command but didn't work.

[splunklearner]

This is the _raw data.

"requestHeaders":"X-sony-PSD2-CountryCode: GB\r\nX-sony-Request-Correlation-Id: 50977be2-f86c-451a-b318-50b4dfc46b4a\r\nX-sony-Secondary-Id: 1614874131\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36\r\nX-sony-Channel-Id: OPENBANK\r\nX-sony-TPP-Journey: AISP\r\nX-sony-Locale: GB\r\nToken_Type: ACCESS_TOKEN\r\nX-sony-SoR-CountryCode: GB\r\nx-fapi-interaction-id: 80c0c1c4-ab24-4cc3-9169-4ef8ecfa90ba\r\nX-sony-Tpp-Name: TrueLayer Limited\r\nContent-Type: application/json\r\nX-sony-Global-Channel-Id: OPENBANK\r\nAccept: application/json\r\nX-sony-Client-Id: 5ec4d197-f5f9-432d-8201-e55618ba970e\r\nX-sony-Chnl-CountryCode: GB\r\nX-sony-Chnl-Group-Member: HRFB\r\nX-sony-Tpp-Id: 001580000103UAAAA2\r\nX-sony-Session-Correlation-Id: 4137bff6-c7e2-40f9-a1ca-699f59bcd6ed\r\nX-sony-Source-System-Id: 4910787\r\nX-sony-TPP-URL: https://api.ob.sony.co.uk/obie/open-banking/v4.0/aisp/accounts/50l6Ph5oSYfmYYnARlvAWtNimns1vO1Vo-r/t...r\nX-sony-GBGF: RBWM\r\nx-sony-consumer-id: OPENBANKING.OBK_MULESOFT_P\r\nX-sony-Username: arielle1@\r\nX-Forwarded-For: 176.34.193.116\r\nX-sony-Client-Name: TrueLayer\r\nX-sony-Software-Id: gdce9LdcLmKHv2MoEtKdPe\r\nX-Amzn-Trace-Id: Root=1-685ae0f4-a3640d152af9aa6aa7092caa;Sampled=0\r\nHost: rbwm-api.sony.co.uk\r\nConnection: Keep-Alive\r\nAccept-Encoding: gzip,deflate\r\nremove-dup-edge-ctrl-headers-rollout-enabled: 1\r\n",

[ITWhisperer · Accepted solution]

Try something like this

| rex field=httpMessage.requestHeaders "User-Agent: (?<useragent>.*?)\\r\\n"