Splunk Search

How can I parse field with unescaped data?

yk010123
Path Finder

I have the following log : 

data=123 params="{"limit":200,"id":["123"] someotherdata

 

How can I parse the params field to a table so that the final output is 

 

data params
123 "{"limit":200,"id":["123"]

 

if I try table data params

 

It ends up being : 

 

data params
123 {

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You already have the data field, so we'll use the rex command to extract the param field.  I'll assume the field ends with the first space.

... | rex "params=(?<params>\S+)"
| table data params

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...