Splunk Search

How to extract json values

tsm0099
Explorer

I have an event in json which has key pairs like:

{

"timestamp": 157281937,

"message":"abc\xyz\pqr\efg",

}

 

I have to create a table of message with with four columns and the columns in the table will have the values abc,xyz,qpr,efg...

 

How can i do this?

 

Thanks in advance!

 

Labels (1)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw |eval _raw="{
\"timestamp\": 157281937,
\"message\":\"abc\xyz\pqr\efg\",
}"
| rex mode=sed "s/,\s+}/}/g s/\\\/#/g"
| spath message
| rex field=message "(?<col1>\w+)#(?<col2>\w+)#(?<col3>\w+)#(?<col4>\w+)"

Why don't you change the characters?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| spath message
| rex field=message "(?<col1>[^\\\]+)\\\(?<col2>[^\\\]+)\\\(?<col3>[^\\\]+)\\\(?<col4>.+)"
| table col1 col2 col3 col4

 

0 Karma

tsm0099
Explorer

Throws an error...

Regex: missing terminating for character class.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try your data and the rex expression at regex101.com to see where the error is coming from.

0 Karma

tsm0099
Explorer

It works fine in regex101...

But when i use it in splunk search it throws the error:

Encountered the following error while compiling the regex '(?<col1>[^\]+)\(?<col2>[^\]+)\(?<col3>[^\]+)\(?<col4>.+)'

 

Note: in the error regex i only see single \ instead of \\

 

Do you have any idea about thia?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need \\ in regex and \\\ in splunk

ITWhisperer_0-1603793912587.png

 

| makeresults | eval _raw="abc\\xyz\\pqr\\efg"
| rex "(?<col1>[^\\\]+)\\\(?<col2>[^\\\]+)\\\(?<col3>[^\\\]+)\\\(?<col4>.+)"

ITWhisperer_0-1603794333524.png

 

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...