Splunk Search

How to extract json values

tsm0099
Explorer

I have an event in json which has key pairs like:

{

"timestamp": 157281937,

"message":"abc\xyz\pqr\efg",

}

 

I have to create a table of message with with four columns and the columns in the table will have the values abc,xyz,qpr,efg...

 

How can i do this?

 

Thanks in advance!

 

Labels (1)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw |eval _raw="{
\"timestamp\": 157281937,
\"message\":\"abc\xyz\pqr\efg\",
}"
| rex mode=sed "s/,\s+}/}/g s/\\\/#/g"
| spath message
| rex field=message "(?<col1>\w+)#(?<col2>\w+)#(?<col3>\w+)#(?<col4>\w+)"

Why don't you change the characters?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| spath message
| rex field=message "(?<col1>[^\\\]+)\\\(?<col2>[^\\\]+)\\\(?<col3>[^\\\]+)\\\(?<col4>.+)"
| table col1 col2 col3 col4

 

0 Karma

tsm0099
Explorer

Throws an error...

Regex: missing terminating for character class.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try your data and the rex expression at regex101.com to see where the error is coming from.

0 Karma

tsm0099
Explorer

It works fine in regex101...

But when i use it in splunk search it throws the error:

Encountered the following error while compiling the regex '(?<col1>[^\]+)\(?<col2>[^\]+)\(?<col3>[^\]+)\(?<col4>.+)'

 

Note: in the error regex i only see single \ instead of \\

 

Do you have any idea about thia?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need \\ in regex and \\\ in splunk

ITWhisperer_0-1603793912587.png

 

| makeresults | eval _raw="abc\\xyz\\pqr\\efg"
| rex "(?<col1>[^\\\]+)\\\(?<col2>[^\\\]+)\\\(?<col3>[^\\\]+)\\\(?<col4>.+)"

ITWhisperer_0-1603794333524.png

 

 

Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...