How extract specific value ?

[Jean-Sébastien]

Hello, 

I have big and complete log and want to extract specific value. 

Small part of log: "state":{"running":{"startedAt":"2024-12-19T13:58:14Z"}}}],

I would like to extract running in this case, value can be other . 

Could you please help me ? 

[ITWhisperer]

This looks like it might be JSON. Have you looked at the json functions?

[kiran_panchavat]

@Jean-Sébastien 

You can use rex command. The rex command matches the value of the specified field against the unanchored regular expression and extracts the named groups into fields of the corresponding names.

https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/Rex 

[kiran_panchavat]

Hello @Jean-Sébastien 

You can use regex. This will create a new field called output that contains the values running, drinking, and walking. Let me know if you need more assistance!

[yuanliu]

It is best not to use rex to extract information from structured data.  As @ITWhisperer says, the OP should post complete sample logs instead of a fragment of JSON.  If the raw event is itself compliant JSON, there should be no need to extract using search commands because Splunk automatically does this at search time.