Splunk Search

How can I parse field with unescaped data?

yk010123
Path Finder

I have the following log : 

data=123 params="{"limit":200,"id":["123"] someotherdata

 

How can I parse the params field to a table so that the final output is 

 

data params
123 "{"limit":200,"id":["123"]

 

if I try table data params

 

It ends up being : 

 

data params
123 {

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You already have the data field, so we'll use the rex command to extract the param field.  I'll assume the field ends with the first space.

... | rex "params=(?<params>\S+)"
| table data params

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...