Splunk Search

How to extract values inside of the {}?

napoleon182
Explorer

Hello Splunk Ninjas!

I will require your assistance with designing my regex expression.

I need to filter for the value of Message in this sample log line:

 

2022-09-23T13:20:25.765+01:00 [29] WARN Core.ErrorResponse - {} - Error message being sent to user with Http Status code: BadRequest:
{"Details":{"field1":value,"field2":"value2"},"Message":"This is the message.","UserMessage":null,"Code":86,"Explanation":null,"Resolution":null,"Category":4}

 

I will be interested in extracting value of field1, field2 (inside of {Details}, message and code,

Any help, much appreciated!

Thanks again

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is fairly simple, but I suspect you are struggling to extract all fields with a single regex.  Don't worry about that.  Using multiple rex commands is much easier and has little performance penalty.  A complex regex that extracts all fields in one go may be less performant.

| rex "Message\\\":\\\"(?<Message>[^\\\"]+)"
| rex "field1\\\":\\\"(?<field1>[^\\\"]+)"
| rex "field2\\\":\\\"(?<field2>[^\\\"]+)"
| rex "Code\\\":(?<Code>\d+)"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is fairly simple, but I suspect you are struggling to extract all fields with a single regex.  Don't worry about that.  Using multiple rex commands is much easier and has little performance penalty.  A complex regex that extracts all fields in one go may be less performant.

| rex "Message\\\":\\\"(?<Message>[^\\\"]+)"
| rex "field1\\\":\\\"(?<field1>[^\\\"]+)"
| rex "field2\\\":\\\"(?<field2>[^\\\"]+)"
| rex "Code\\\":(?<Code>\d+)"
---
If this reply helps you, Karma would be appreciated.

gcusello
SplunkTrust
SplunkTrust

@napoleon182,

this seems to be a json format, did you tried with spath command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath)?

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...