Splunk Search

How to extract value of a required field using regx?


msg INFO | 2021-10-14 10:38 PM |  Message consumed: {"InputAmountToCredit":"22.67","CurrencyCode":"AUD","Buid":"1401","OrderNumber":"877118406","ID":"58916"}

In above sample data, I want to extract "InputAmount" to credit.  Also I wan to extract "ID" and perform another search to get its status (as status is in another event and needs to be extracted by mapping ID) 

This is for logs and I have lots of events to perform search on to generate report.

Any help would be appreciated.

Labels (4)
0 Karma



Can you please try this?

|rex field=_raw "\"InputAmountToCredit\":\"(?<InputAmountToCredit>[^\"]+).+\"ID\":\"(?<ID>[^\"]+)"


My Sample Search :

| makeresults 
| eval _raw="msg:  INFO | 2021-10-14 10:38 PM |  Message consumed: {\"InputAmountToCredit\":\"22.67\",\"CurrencyCode\":\"AUD\",\"Buid\":\"1401\",\"OrderNumber\":\"877118406\",\"ID\":\"58916\"}"
|rex field=_raw "\"InputAmountToCredit\":\"(?<InputAmountToCredit>[^\"]+).+\"ID\":\"(?<ID>[^\"]+)"

▄︻̷̿┻̿═━一   😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!