Help with Regex to extract values

[napoleon182]

Hello Splunk Ninjas!

I'm new to the group (and to the splunk) and will require your assistance with designing my regex expression.

I need to filter for the value of Message in this sample log line:

2022-09-23T13:20:25.765+01:00 [29] WARN  Core.ErrorResponse - {} - Error message being sent to user with Http Status code: BadRequest:
{"Message":"Sorry, only real values are valid in this environment.","UserMessage":null,"Code":64,"Explanation":null,"Resolution":null,"Category":3}

I will be interested in extracting value of Message, Code, Resolution and Category,

Any help, much appreciated!

Thanks again

[gcusello]

Hi @napoleon182,

this seems to be a json format, so you could use the spath command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/spath).

otherwise, you could use a regex like the following

| rex "\{\"Message\":\"(?<message>[^\"]+).*\"Code\":(?<Code>\d+),\"Explanation\":(?<Explanation>[^,]+),\"Resolution\":(?<Resolution>[^,]+),\"Category\":(?<Category>\d+)"

tha you can test at https://regex101.com/r/3YCPYQ/1

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @napoleon182,

as you said, using the table command:

<your_search>
| rex "\{\"Message\":\"(?<Message>[^\"]+).*\"Code\":(?<Code>\d+),\"Explanation\":(?<Explanation>[^,]+),\"Resolution\":(?<Resolution>[^,]+),\"Category\":(?<Category>\d+)"
| table Message Code Explanation Resolution Category

Ciao.

Giuseppe

[napoleon182]

Thank you Guiseppe, thats perfect, many thanks for your assistance!

[napoleon182]

Thank you Giuseppe, how can i now present it in the table? (with using the | table switch)