Splunk Search

How to extract JSON from event data with rex?

robertlabrie
Path Finder

I get Amazon SES bounce notifications via email. I'm using the IMAP plugin to read that email. Works fine. The email includes a JSON payload in the body of the email. I'm extracting it thusly:

index=mail "notificationType\":\"Bounce\",\"bounce" |  rex "\{(?<json_data>.*)" | eval json_data="{".json_data | spath input=json_data

It works fine, but my Regex-foo is poor and I don't know how to keep the leading brace, which is why I'm re-attaching it with an eval later. It works, but it's ugly and embarrassing. If anyone with Regex skills could take a look, it would help a lot.

Thanks,
Rob

Tags (3)
1 Solution

somesoni2
Revered Legend

Try this

 index=mail "notificationType\":\"Bounce\",\"bounce" |  rex "(?<json_data>\{.*)" | spath input=json_data

View solution in original post

somesoni2
Revered Legend

Try this

 index=mail "notificationType\":\"Bounce\",\"bounce" |  rex "(?<json_data>\{.*)" | spath input=json_data
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...