I have a string like below and unable to extract accuratly with rex command please suggest any alternative way.
_raw----------------
{lable:harish,message: Say something, location:India, state:TS,qual:xyz}
{message: say nothing,lable:harish, location:India, state:TS,qual:xyz}
{lable:harish, location:India, state:TS,qual:xyz,message: say splunk splunk answers}
The message value is randomized location and I need to pick the message value.
When I try with below command it is not considering the proper end position. Please suggest
|rex "message:(?<Message_value>.*)[,|}]" |table Message_Value
Field names are case-sensitive, also, you are using a greedy match which may pick up more than you bargained for - try this
|rex "message:(?<Message_Value>.*?)[,|}]" |table Message_Value
Field names are case-sensitive, also, you are using a greedy match which may pick up more than you bargained for - try this
|rex "message:(?<Message_Value>.*?)[,|}]" |table Message_Value
Thank you so much.., I was trying a lot of thing like field extraction and regex and you helped it well with ?.