my usecase is like the values under ipblock/adaptive should extract under new filed name including ipblock value as well in that new field name.
Output: under new field name eg. ip_attack
@balu1211I am glad you finally started to explain what you are trying to do in the other thread Re: Help with the field extraction and regex. So, based on this, you have a conformant JSON, therefore you must already have a field named tag that is extracted already. Applying the same technique from the other thread,
| rex field=tag mode=sed "s/AKAMAI\/(\w+)\/(.+)/AKAMAI_\1=\"\2\"/" | rex field=tag mode=sed "s/ASE\/(\w+)\/(.+)/ASE\/\1=\"\2\"/" | rex field=tag mode=sed "s/(IPBLOCK\/.+)/ip_Attack=\"\1\"/" | rex field=tag mode=sed "s/(CUSTOM_AKA\/.+)/Custom_Rules=\"\1\"/" ``` convert structured paths to key-value pairs ``` | rename _raw as temp, tag as _raw ``` extract works on _raw only ``` | kv ``` extract key-value pairs ``` | rename temp as _raw
This is the same formula I posted there, except it was never clear that you had a field named "tag" and that the data was somehow related to your initial question.
Hi @balu1211 ,
this is a regex to extract the tag vales:
| rex "\"tag\":\"(?<tag>[^\"]*)"
that you can test at https://regex101.com/r/mGxdvh/1
Anyway, as hinted by @ITWhisperer, I hint to explore the spath command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath) to extract all the fields from your json file.