Splunk Search
Highlighted

How to use rex to extract JSON format to 2 keyValue pairs?

New Member
2016/11/14 17:27:35:449||DeviceID=12C95D85-AC78-499A-A018-E8ADB1CC6D0E||LogLevel=Info||AppVersion=v1.0.4.8(1.0)||OSType=iPhone OS||OSVersion=8.3||ConnectStatus=1||UploadTime=2016/11/14 17:27:35:449||RemoteClientIP=192.168.255.239||ClientID=(null)||Coordinate=25.054545,121.548664||Event=1||TransactionDetail={
  "Event" : "StartiEasy"
}

I want to extract 2 field first "msg" "value":

Event

"msg2" field "value":

StartiEasy

Please advise.. Thanks.

0 Karma
Highlighted

Re: How to use rex to extract JSON format to 2 keyValue pairs?

SplunkTrust
SplunkTrust

Here's one way

... | rex "{\s+\"(?<msg>[^\"]+)\"\s:\s\"(?<value>[^\"]+)\"\s+}" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: How to use rex to extract JSON format to 2 keyValue pairs?

New Member

Sorry, the result as below

source="ieasy.log" host="ivan-pc" sourcetype="ieasy" 
| rex "{\s+\"(?<msg>[^\"]+)\"\s:\s\"(?<value>[^\"]+)\"\s+}\"

Unbalanced quotes.

0 Karma
Highlighted

Re: How to use rex to extract JSON format to 2 keyValue pairs?

SplunkTrust
SplunkTrust

Sorry about that. I fixed my answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to use rex to extract JSON format to 2 keyValue pairs?

New Member

It's OK, Thanks a lot.

0 Karma