How to extract values inside of the {}?

[napoleon182]

Hello Splunk Ninjas!

I will require your assistance with designing my regex expression.

I need to filter for the value of Message in this sample log line:

2022-09-23T13:20:25.765+01:00 [29] WARN Core.ErrorResponse - {} - Error message being sent to user with Http Status code: BadRequest:
{"Details":{"field1":value,"field2":"value2"},"Message":"This is the message.","UserMessage":null,"Code":86,"Explanation":null,"Resolution":null,"Category":4}

I will be interested in extracting value of field1, field2 (inside of {Details}, message and code,

Any help, much appreciated!

Thanks again

[richgalloway · Accepted solution]

This is fairly simple, but I suspect you are struggling to extract all fields with a single regex.  Don't worry about that.  Using multiple rex commands is much easier and has little performance penalty.  A complex regex that extracts all fields in one go may be less performant.

| rex "Message\\\":\\\"(?<Message>[^\\\"]+)"
| rex "field1\\\":\\\"(?<field1>[^\\\"]+)"
| rex "field2\\\":\\\"(?<field2>[^\\\"]+)"
| rex "Code\\\":(?<Code>\d+)"

[gcusello]

i @napoleon182,

this seems to be a json format, did you tried with spath command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath)?

Ciao.

Giuseppe