Splunk Search

How to use rex to extract JSON text in "msg" keyValue pair?

kabSplunk
Explorer

I have a json raw string from which I have to extract the "msg" key and pair value. Can you please assist. The log line looks like below:

<6>2015-11-26T17:00:15Z x45678fnjotq5 doe[88]: {"ddcfa_app_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsa","ddcfa_app_name":"paymentManagementApplication","ddcfa_org_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsasdas63g3664-s35d-33sfa","ddcfa_space_name":"noShowMessage","event_type":"LogMessage","level":"info","message_type":"OUT","msg":"DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()","origin":"rep","source_instance":"0","source_type":"APP","time":"2015-11-26T17:00:15Z","timestamp":1477069200012312311} 

I want to extract "msg" field's "value":

DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()
Tags (3)
0 Karma
1 Solution

gokadroid
Motivator
yourBaseQuery
|rex ".*,\"msg\":\"(?<message>.*)\",\"origin\""
| complete yourSearch

View solution in original post

vaizpatu
Engager

.*"msg":"(?P<message>[^="]+).*

0 Karma

gokadroid
Motivator
yourBaseQuery
|rex ".*,\"msg\":\"(?<message>.*)\",\"origin\""
| complete yourSearch

gokadroid
Motivator

Adding this for reference @bsrikanthreddy5 

`|eval nowstring=strftime(now(), "%Y-%m-%d")`

adayton20
Contributor

Is this what you're looking for?

 ... | rex field=_raw "msg\":\"(?P<msg>.[^\"\,\"]*)" | table msg

Appears to work for me:

alt text

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...