Filter data from json file

[drogo]

Team,
I am bit new to Splunk, need help to pull ERR message from below sample raw data. 

{"hosting_environment": "nonp", "application_environment": "nonp", "message": "[20621] 2024/11/14 12:39:46.899958 [ERR] 10.25.1.2:30080 - pid:96866" - unable to connect to endpoint , "service": "hello world"}

Thanks!

[yuanliu]

If your events are truly in JSON, you are asking the wrong question.  Let me explain.

The sample you illustrated above is not JSON compliant.  Specifically, quotation marks are badly placed.  So, the most important question is whether the sample is faithful.  Or do you mean a compliant JSON like this:

{"hosting_environment": "nonp", "application_environment": "nonp", "message": "[20621] 2024/11/14 12:39:46.899958 [ERR] 10.25.1.2:30080 - pid:96866 - unable to connect to endpoint", "service": "hello world"}

Assuming your raw events are JSON compliant, Splunk would give you a field named message.  The task is simply to extract the desired part from this field.  In other words, the fact that data is JSON should have no bearing on your question.  If I read your mind correctly, you want the string after [ERR]. (I'm not joking about reading mind.  You should always illustrate what you want using sample data.)  Therefore

| rex field=message "\[ERR\] (?<error>.+)"

If, on the other hand, your raw events are mangled like in your illustration, the answer will depend on how badly mangled the events are.  The best solution would be to implore your developers to fix the log.

Either way, the question is really not about JSON.

[gcusello]

Hi @drogo ,

if you use the INDEXED_EXTRACTIONS=JSON option for the sourcetype you're using for those data, you have all the fileds extracted.

If you don't see this field, youcan use a regex to extract it:

| rex "\d*\s\[(?<message>[^\]]+)"

that you can test at https://regex101.com/r/QcGAwT/1

Ciao.

Giuseppe

[ITWhisperer]

This is a bit vague - Do you want to search for events that have ERR in? Do you want to extract what comes after "[ERR}" in the message field? Do you already have these JSON fields extracted?