I have splunk logs as given below. However, I wanted display fields in between square brackets "[ ]" in a table as given below. Please advise.
Expeted query result in a table
sqsMsgId | snsMsgId | requestId
dec6c564-9e1c-4d0f-8e5e-ac9dc7bdf14a | 7d81b4cf-43c0-5bb4-8370-ef064a78da16 | d487108c-863f-5ab2-96df-4b458f97c74e
My splunk Logs
{"level":"info","message":"[sqsMsgId=dec6c564-9e1c-4d0f-8e5e-ac9dc7bdf14a | snsMsgId=7d81b4cf-43c0-5bb4-8370-ef064a78da16 | workItemKey=CAMP:MI4:ORG_ID:103857:7fbf0f46-4131-404d-9a13-57cdff7c473a | requestId=d487108c-863f-5ab2-96df-4b458f97c74e | status=SUCCESS | ags=CAMP | component=MI4 | duration=383]","requestId":"d487108c-863f-5ab2-96df-4b458f97c74e"}
| rex "sqsMsgId=(?<sqsMsgId>\S+)\s.*?snsMsgId=(?<snsMsgId>\S+)\s.*?requestId=(?<requestId>\S+)\s"
Thank you for your quick response. However, I would like to display key value fields in table where field delimiter is "|" and key-value delimiter is "=". Please advise.
<base_search>
| rex "^[^\[]*\[(?<_raw>[^\]]*)"
| extract pairdelim="|" kvdelim="="