How to extract values from a JSON like string?

[kotig]

I am having data like this in my Splunk and I wanted to extract the value of status which is Active.

How can I do it when this is not a valid JSON string?

mydata {
name {
value: "1111"
}
id {
value: "2020-07-02 15:49:00"
}
status {
value: "Active"
}
}
Any help is appreciated.

[richgalloway]

Assuming that's all one event, then rex should do the job.

... | rex "status \{\nvalue: \"(?<status>\w+)"

[kotig]

yea i tried the rex. But it did not work. What i did was search splunk and put them into a table and then tried the rex as mentioned above but i had no luck.

[richgalloway]

Please elaborate. What search did you use? What does the table look like? What rex did you try?

[kotig]

index=mysearchIndex | table message | rex "status \{\nvalue: \"(?<status>\w+)" | table status

Here - message contains contains the string like below:

message

-----------

mydata {
name {
value: "1111"
}
id {
value: "2020-07-02 15:49:00"
}
status {
value: "Active"
}
}

[bowesmana · Accepted solution]

@kotig You are not specifying field=message in the rex command, so it is looking at _raw which no longer exists after your table message statement

| makeresults
| eval message="mydata {
name {
value: \"1111\"
}
id {
value: \"2020-07-02 15:49:00\"
}
status {
value: \"Active\"
}
}"
| rex field=message "status \{\nvalue: \"(?<status>\w+)" | table status

[kotig]

Thank you @richgalloway and @bowesmana . That worked.