I am having data like this in my Splunk and I wanted to extract the value of status which is Active.
How can I do it when this is not a valid JSON string?
mydata {
name {
value: "1111"
}
id {
value: "2020-07-02 15:49:00"
}
status {
value: "Active"
}
}
Any help is appreciated.
@kotig You are not specifying field=message in the rex command, so it is looking at _raw which no longer exists after your table message statement
| makeresults
| eval message="mydata {
name {
value: \"1111\"
}
id {
value: \"2020-07-02 15:49:00\"
}
status {
value: \"Active\"
}
}"
| rex field=message "status \{\nvalue: \"(?<status>\w+)" | table status
Assuming that's all one event, then rex should do the job.
... | rex "status \{\nvalue: \"(?<status>\w+)"
yea i tried the rex. But it did not work. What i did was search splunk and put them into a table and then tried the rex as mentioned above but i had no luck.
index=mysearchIndex | table message | rex "status \{\nvalue: \"(?<status>\w+)" | table status
Here - message contains contains the string like below:
message
-----------
mydata {
name {
value: "1111"
}
id {
value: "2020-07-02 15:49:00"
}
status {
value: "Active"
}
}
@kotig You are not specifying field=message in the rex command, so it is looking at _raw which no longer exists after your table message statement
| makeresults
| eval message="mydata {
name {
value: \"1111\"
}
id {
value: \"2020-07-02 15:49:00\"
}
status {
value: \"Active\"
}
}"
| rex field=message "status \{\nvalue: \"(?<status>\w+)" | table status
Thank you @richgalloway and @bowesmana . That worked.