Hello,
I have a log file that go like this
2022-09-30 09:43:41,038: INSTANCE=34-bankgw1, REF=237324562, MESSSAGE=IST2InterfaceModel.ResponseVerifyCardFromBank:{"F0":"0210","F2":"970422xxxxxx6588","F3":"050000","F4":"000001000000","F7":"0930094340","F9":"00000001","F11":"277165","F12":"094340","F13":"0930","F15":"0930","F18":"7399","F25":"08","F32":"970471","F37":"273094277165","F38":"277165","F39":"15","F41":"00005782",0822,237324562,VNPAYCE","F49":"704","F54":"0000000000000000000000000000000000000000","F62":"EC_CARDVER","F63":"AAsA7QKwYzZX3AAB","F102":"0000000000000000"}
With a log structure like this, I can't really extract the field that I want with Splunk field extractor. The field that I want to Extract is F39 (which mean status) for monitoring purpose.
I'm really amateur when it come to rex so can anyone help me with it?
Give this a try
|rex field=_raw "\"F39\"\:\"(?<F39>\d+?)\""
Most of this log can be extracted using this method. The fields with a string value will need to be changed.
Give this a try
|rex field=_raw "\"F39\"\:\"(?<F39>\d+?)\""
Most of this log can be extracted using this method. The fields with a string value will need to be changed.
Thanks, this work perfectly, but can I ask why fields with string value need to be change and why?
Hi @phamxuantung ,
It's because the regex I have you is looking for digits using \d
In this example, field F62 is extracted. I used a wildcard so it will catch anything in that field regardless of digit or string match.
|rex field=_raw "\"F62\"\:\"(?<F62>.+?)\""