Hello Splunk Ninjas!
I will require your assistance with designing my regex expression.
I need to filter for the value of Message in this sample log line:
2022-09-23T13:20:25.765+01:00 [29] WARN Core.ErrorResponse - {} - Error message being sent to user with Http Status code: BadRequest:
{"Details":{"field1":value,"field2":"value2"},"Message":"This is the message.","UserMessage":null,"Code":86,"Explanation":null,"Resolution":null,"Category":4}
I will be interested in extracting value of field1, field2 (inside of {Details}, message and code,
Any help, much appreciated!
Thanks again
This is fairly simple, but I suspect you are struggling to extract all fields with a single regex. Don't worry about that. Using multiple rex commands is much easier and has little performance penalty. A complex regex that extracts all fields in one go may be less performant.
| rex "Message\\\":\\\"(?<Message>[^\\\"]+)"
| rex "field1\\\":\\\"(?<field1>[^\\\"]+)"
| rex "field2\\\":\\\"(?<field2>[^\\\"]+)"
| rex "Code\\\":(?<Code>\d+)"
This is fairly simple, but I suspect you are struggling to extract all fields with a single regex. Don't worry about that. Using multiple rex commands is much easier and has little performance penalty. A complex regex that extracts all fields in one go may be less performant.
| rex "Message\\\":\\\"(?<Message>[^\\\"]+)"
| rex "field1\\\":\\\"(?<field1>[^\\\"]+)"
| rex "field2\\\":\\\"(?<field2>[^\\\"]+)"
| rex "Code\\\":(?<Code>\d+)"
i @napoleon182,
this seems to be a json format, did you tried with spath command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath)?
Ciao.
Giuseppe