Splunk Search

How do you use rex to extract a specific field in Splunk?

braicu
New Member

Hello,

Can anybody help me extracting from this table with 3 regular expression:

I got a column in Splunk like this and the values between

Custom_Tag (this is the column name which i need to be split into 3 columns Account,AssetOwner,AssetDataStored)
"Key": "Account", "Value": "037395386785"
"Key": "AssetOwner", "Value": "Infrastructure"
"Key": "AssetDataStored", "Value": "InternalUseOnly"
"Key": "Account", "Value": "343254354354"
"Key": "AssetOwner", "Value": "Production"
"Key": "AssetDataStored", "Value": "ExternalUse"

and i need a rex to extract the values into 3 columns when matching the word Account,AssetOwner,AssedDataStored

Tag_Account Tag_AssetOwner Tag_AssetDataStored
037395386785 Infrastructure InternalUseOnly
343254354354 Production ExternalUse

0 Karma
1 Solution

FrankVl
Ultra Champion

Something like this should work:

| rex field=Custom_Tag "\"Account\",\s+\"Value\":\s+\"(?<Tag_Account>[^\"]+)"
| rex field=Custom_Tag "\"AssetOwner\",\s+\"Value\":\s+\"(?<Tag_AssetOwner>[^\"]+)"
| rex field=Custom_Tag "\"AssetDataStored\",\s+\"Value\":\s+\"(?<Tag_AssetDataStored>[^\"]+)"

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval Custom_Tag ="\"Key\": \"Account\", \"Value\": \"037395386785\"" 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetOwner\", \"Value\": \"Infrastructure\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetDataStored\", \"Value\": \"InternalUseOnly\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"Account\", \"Value\": \"343254354354\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetOwner\", \"Value\": \"Production\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetDataStored\", \"Value\": \"ExternalUse\""] 
| eval temp = replace(Custom_Tag , "\"|:|Key|Value","") 
| makemv delim="," temp 
| eval column1 = ltrim(mvindex(temp,0)) 
| eval column2=ltrim(mvindex(temp,1)) 
| eval{column1}=column2 
| stats list(Account) as Tag_Account,list(AssetDataStored) as Tag_AssetDataStored,list(AssetOwner) as Tag_AssetOwner
0 Karma

FrankVl
Ultra Champion

Something like this should work:

| rex field=Custom_Tag "\"Account\",\s+\"Value\":\s+\"(?<Tag_Account>[^\"]+)"
| rex field=Custom_Tag "\"AssetOwner\",\s+\"Value\":\s+\"(?<Tag_AssetOwner>[^\"]+)"
| rex field=Custom_Tag "\"AssetDataStored\",\s+\"Value\":\s+\"(?<Tag_AssetDataStored>[^\"]+)"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...