Splunk Search

How to use extract using rex command?

wvsgo215
Engager

"Context":"{"user id":"jane.doe.sen", "Expense Date":"11/10/2022",

How to use extract this rex command?     

to come up result like 

user id Expense Date
jane.doe.sen 9/6/2022

please help                                                                                              

Labels (1)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Assuming the field is as written and is in the _raw field

| rex "user id\":\"(?<user_id>[^\"]*)\",\s+\"Expense Date\":\"(?<expense_date>[^\"]*)"
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...