Splunk Search

How do you use rex to extract a specific field in Splunk?

braicu
New Member

Hello,

Can anybody help me extracting from this table with 3 regular expression:

I got a column in Splunk like this and the values between

Custom_Tag (this is the column name which i need to be split into 3 columns Account,AssetOwner,AssetDataStored)
"Key": "Account", "Value": "037395386785"
"Key": "AssetOwner", "Value": "Infrastructure"
"Key": "AssetDataStored", "Value": "InternalUseOnly"
"Key": "Account", "Value": "343254354354"
"Key": "AssetOwner", "Value": "Production"
"Key": "AssetDataStored", "Value": "ExternalUse"

and i need a rex to extract the values into 3 columns when matching the word Account,AssetOwner,AssedDataStored

Tag_Account Tag_AssetOwner Tag_AssetDataStored
037395386785 Infrastructure InternalUseOnly
343254354354 Production ExternalUse

0 Karma
1 Solution

FrankVl
Ultra Champion

Something like this should work:

| rex field=Custom_Tag "\"Account\",\s+\"Value\":\s+\"(?<Tag_Account>[^\"]+)"
| rex field=Custom_Tag "\"AssetOwner\",\s+\"Value\":\s+\"(?<Tag_AssetOwner>[^\"]+)"
| rex field=Custom_Tag "\"AssetDataStored\",\s+\"Value\":\s+\"(?<Tag_AssetDataStored>[^\"]+)"

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval Custom_Tag ="\"Key\": \"Account\", \"Value\": \"037395386785\"" 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetOwner\", \"Value\": \"Infrastructure\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetDataStored\", \"Value\": \"InternalUseOnly\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"Account\", \"Value\": \"343254354354\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetOwner\", \"Value\": \"Production\""] 
| append 
    [| makeresults 
    | eval Custom_Tag ="\"Key\": \"AssetDataStored\", \"Value\": \"ExternalUse\""] 
| eval temp = replace(Custom_Tag , "\"|:|Key|Value","") 
| makemv delim="," temp 
| eval column1 = ltrim(mvindex(temp,0)) 
| eval column2=ltrim(mvindex(temp,1)) 
| eval{column1}=column2 
| stats list(Account) as Tag_Account,list(AssetDataStored) as Tag_AssetDataStored,list(AssetOwner) as Tag_AssetOwner
0 Karma

FrankVl
Ultra Champion

Something like this should work:

| rex field=Custom_Tag "\"Account\",\s+\"Value\":\s+\"(?<Tag_Account>[^\"]+)"
| rex field=Custom_Tag "\"AssetOwner\",\s+\"Value\":\s+\"(?<Tag_AssetOwner>[^\"]+)"
| rex field=Custom_Tag "\"AssetDataStored\",\s+\"Value\":\s+\"(?<Tag_AssetDataStored>[^\"]+)"
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...