Splunk Search

How to extract value of a required field using regx?

hrishi_deshpand
Explorer

msg INFO | 2021-10-14 10:38 PM |  Message consumed: {"InputAmountToCredit":"22.67","CurrencyCode":"AUD","Buid":"1401","OrderNumber":"877118406","ID":"58916"}

In above sample data, I want to extract "InputAmount" to credit.  Also I wan to extract "ID" and perform another search to get its status (as status is in another event and needs to be extracted by mapping ID) 

This is for logs and I have lots of events to perform search on to generate report.

Any help would be appreciated.

Labels (4)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@hrishi_deshpand 

Can you please try this?

YOUR_SEARCH
|rex field=_raw "\"InputAmountToCredit\":\"(?<InputAmountToCredit>[^\"]+).+\"ID\":\"(?<ID>[^\"]+)"

 

My Sample Search :

| makeresults 
| eval _raw="msg:  INFO | 2021-10-14 10:38 PM |  Message consumed: {\"InputAmountToCredit\":\"22.67\",\"CurrencyCode\":\"AUD\",\"Buid\":\"1401\",\"OrderNumber\":\"877118406\",\"ID\":\"58916\"}"
|rex field=_raw "\"InputAmountToCredit\":\"(?<InputAmountToCredit>[^\"]+).+\"ID\":\"(?<ID>[^\"]+)"


 Thanks
KV
▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!