Splunk Search

How to use rex to extract JSON text in "msg" keyValue pair?

Explorer

I have a json raw string from which I have to extract the "msg" key and pair value. Can you please assist. The log line looks like below:

<6>2015-11-26T17:00:15Z x45678fnjotq5 doe[88]: {"ddcfa_app_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsa","ddcfa_app_name":"paymentManagementApplication","ddcfa_org_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsasdas63g3664-s35d-33sfa","ddcfa_space_name":"noShowMessage","event_type":"LogMessage","level":"info","message_type":"OUT","msg":"DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()","origin":"rep","source_instance":"0","source_type":"APP","time":"2015-11-26T17:00:15Z","timestamp":1477069200012312311} 

I want to extract "msg" field's "value":

DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()
Tags (3)
0 Karma
1 Solution

Motivator
yourBaseQuery
|rex ".*,\"msg\":\"(?<message>.*)\",\"origin\""
| complete yourSearch

View solution in original post

Motivator
yourBaseQuery
|rex ".*,\"msg\":\"(?<message>.*)\",\"origin\""
| complete yourSearch

View solution in original post

Contributor

Is this what you're looking for?

 ... | rex field=_raw "msg\":\"(?P<msg>.[^\"\,\"]*)" | table msg

Appears to work for me:

alt text

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!