How to extract a key value pair, convert it to a JSON format and assign it to a variable using eval?

[nibinabr]

Hi Guys,

I have a log event like the following

2015-01-08T08:56:30.835Z "Name:John"="21","Name:Sam"="29","Name:Jim"="40"

.....(not just three)

How do I extract the Name and the corresponding number and convert it in to a JSON format like the one below.
{John:21,Sam:29,Jim:40}

I can extract the name and the number, but what I'm not sure about is how I can change it to the JSON format above.

NB: I need to assign this json formatted string to a variable using eval.
eval new_var=[search that generate the JSON formatted string]

[_d_ · Accepted solution]

What exactly are you going to use new_var for because you can export extracted name and number fields directly from the UI as JSON?

A hacky way to convert the entire quoted string of names and numbers into JSON is to essentially extract it wholesale and apply several rex commands to shape it into the correct form:

Field test: "Name:John"="21","Name:Sam"="29","Name:Jim"="40"
Search: | rex field=test mode=sed "s/(\"Name:)|(\")//g" | rex field=test mode=sed "s/=/:/g" | rex field=test mode=sed "s/^/{/" | rex field=test mode=sed "s/$/}/g"

Full example:

| stats count | eval test="\"Name:John\"=\"21\",\"Name:Sam\"=\"29\",\"Name:Jim\"=\"40\"" | rex field=test  mode=sed "s/(\"Name:)|(\")//g" | rex field=test  mode=sed "s/=/:/g" | rex field=test  mode=sed "s/^/{/" | rex field=test  mode=sed "s/$/}/g"

Output:

{John:21,Sam:29,Jim:40} 

[nibinabr]

Your solution solved my problem. But please do let know if you have a better way to get this done.

[nibinabr]

I'm using a splunk app which has a variable that accepts some data in the form of a JSON object (eval app_variable=new_var). What I was trying to do is to convert the data in to a JSON format. Please let me know if you have a better way to do this.