How to extract status for monitoring with a log structure like this?

[phamxuantung]

Hello,

I have a log file that go like this

2022-09-30 09:43:41,038: INSTANCE=34-bankgw1, REF=237324562, MESSSAGE=IST2InterfaceModel.ResponseVerifyCardFromBank:{"F0":"0210","F2":"970422xxxxxx6588","F3":"050000","F4":"000001000000","F7":"0930094340","F9":"00000001","F11":"277165","F12":"094340","F13":"0930","F15":"0930","F18":"7399","F25":"08","F32":"970471","F37":"273094277165","F38":"277165","F39":"15","F41":"00005782",0822,237324562,VNPAYCE","F49":"704","F54":"0000000000000000000000000000000000000000","F62":"EC_CARDVER","F63":"AAsA7QKwYzZX3AAB","F102":"0000000000000000"}

With a log structure like this, I can't really extract the field that I want with Splunk field extractor. The field that I want to Extract is F39 (which mean status) for monitoring purpose.

I'm really amateur when it come to rex so can anyone help me with it?

[chaker · Accepted solution]

Hi @phamxuantung 

Give this a try

|rex field=_raw "\"F39\"\:\"(?<F39>\d+?)\""

Most of this log can be extracted using this method. The fields with a string value will need to be changed.

[phamxuantung]

Thanks, this work perfectly, but can I ask why fields with string value need to be change and why?

[chaker]

Hi @phamxuantung ,

It's because the regex I have you is looking for digits using \d

In this example, field F62 is extracted. I used a wildcard so it will catch anything in that field regardless of digit or string match.

|rex field=_raw "\"F62\"\:\"(?<F62>.+?)\""