How to create the proper search to extract all of the fields and their respective field_values from the sample data?

[Strangertinz]

Hi Splunkers!


Any one able to assist me with a search that I am trying to create below. 

I want to extract some data from multiple json data value fields. I am able to ingest the json data and extract the fields and values correctly.  Sample data below 


{

"key1": "value1",

"key2": "[field1 = field_value1] [field2 = field_value2] [field3 = field_value3] [field4 = field_value4]",

"key3": "value3",

"key4": "[field5 = field_value5] [field6 = field_value6] "
}


I am trying to create the proper search to extract all of the fields and their respective field_values from the sample data above.


Thanks in advance! 

[Strangertinz]

Awesome! Thanks for assisting with the search! ITWhisperer for president! 

[Strangertinz]

Thanks for the prompt and excellent response! 

my apologies for not including this earlier... but what if the json data is nested like the example below?

I would still like to extract field and field values 

{

"key1": "value1",

"key2":  { "key2_key1": "key2_key1_value1",
                   "key2_key2": "key2_key2_value2",
                    "key2_key3" : "[field1 = field_value1] [field2 = field_value2] [field3 = field_value3] [field4 = field_value4]" }

}

[ITWhisperer]

| spath
| rex max_match=0 field=key2.key2_key3 "\[(?<kvpairs>\S+\s=\s[^\]]+)\]"
| mvexpand kvpairs
| rex field=kvpairs "(?<key>\S+)\s=\s(?<value>.+)
| eval {key}=value

[ITWhisperer · Accepted solution]

Assuming this is an accurate representation of your events, try something like this

| rex max_match=0 field=key2 "\[(?<kvpair2>\S+\s=\s[^\]]+)\]"
| rex max_match=0 field=key4 "\[(?<kvpair4>\S+\s=\s[^\]]+)\]"
| eval kvpairs=mvappend(kvpair2, kvpair4)
| mvexpand kvpairs
| rex field=kvpairs "(?<key>\S+)\s=\s(?<value>.+)
| eval {key}=value