How to extract json values

[tsm0099]

I have an event in json which has key pairs like:

{

"timestamp": 157281937,

"message":"abc\xyz\pqr\efg",

}

I have to create a table of message with with four columns and the columns in the table will have the values abc,xyz,qpr,efg...

How can i do this?

Thanks in advance!

[to4kawa]

index=_internal | head 1 | fields _raw |eval _raw="{
\"timestamp\": 157281937,
\"message\":\"abc\xyz\pqr\efg\",
}"
| rex mode=sed "s/,\s+}/}/g s/\\\/#/g"
| spath message
| rex field=message "(?<col1>\w+)#(?<col2>\w+)#(?<col3>\w+)#(?<col4>\w+)"

Why don't you change the characters?

[ITWhisperer]

| spath message
| rex field=message "(?<col1>[^\\\]+)\\\(?<col2>[^\\\]+)\\\(?<col3>[^\\\]+)\\\(?<col4>.+)"
| table col1 col2 col3 col4

[tsm0099]

Throws an error...

Regex: missing terminating for character class.

[ITWhisperer]

Try your data and the rex expression at regex101.com to see where the error is coming from.

[tsm0099]

It works fine in regex101...

But when i use it in splunk search it throws the error:

Encountered the following error while compiling the regex '(?<col1>[^\]+)\(?<col2>[^\]+)\(?<col3>[^\]+)\(?<col4>.+)'

Note: in the error regex i only see single \ instead of \\

Do you have any idea about thia?

[ITWhisperer]

You need \\ in regex and \\\ in splunk

| makeresults | eval _raw="abc\\xyz\\pqr\\efg"
| rex "(?<col1>[^\\\]+)\\\(?<col2>[^\\\]+)\\\(?<col3>[^\\\]+)\\\(?<col4>.+)"