Splunk Search

How to use rex to extract JSON text in "msg" keyValue pair?

kabSplunk
Explorer

I have a json raw string from which I have to extract the "msg" key and pair value. Can you please assist. The log line looks like below:

<6>2015-11-26T17:00:15Z x45678fnjotq5 doe[88]: {"ddcfa_app_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsa","ddcfa_app_name":"paymentManagementApplication","ddcfa_org_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsasdas63g3664-s35d-33sfa","ddcfa_space_name":"noShowMessage","event_type":"LogMessage","level":"info","message_type":"OUT","msg":"DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()","origin":"rep","source_instance":"0","source_type":"APP","time":"2015-11-26T17:00:15Z","timestamp":1477069200012312311} 

I want to extract "msg" field's "value":

DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()
Tags (3)
0 Karma
1 Solution

gokadroid
Motivator
yourBaseQuery
|rex ".*,\"msg\":\"(?<message>.*)\",\"origin\""
| complete yourSearch

View solution in original post

vaizpatu
Engager

.*"msg":"(?P<message>[^="]+).*

0 Karma

gokadroid
Motivator
yourBaseQuery
|rex ".*,\"msg\":\"(?<message>.*)\",\"origin\""
| complete yourSearch

gokadroid
Motivator

Adding this for reference @bsrikanthreddy5 

`|eval nowstring=strftime(now(), "%Y-%m-%d")`

adayton20
Contributor

Is this what you're looking for?

 ... | rex field=_raw "msg\":\"(?P<msg>.[^\"\,\"]*)" | table msg

Appears to work for me:

alt text

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...