Splunk Search

How to use rex to extract JSON text in "msg" keyValue pair?

Explorer

I have a json raw string from which I have to extract the "msg" key and pair value. Can you please assist. The log line looks like below:

<6>2015-11-26T17:00:15Z x45678fnjotq5 doe[88]: {"ddcfa_app_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsa","ddcfa_app_name":"paymentManagementApplication","ddcfa_org_id":"asdkhad23423864-d987r89fsd-234234gsf-234jsfgsasdas63g3664-s35d-33sfa","ddcfa_space_name":"noShowMessage","event_type":"LogMessage","level":"info","message_type":"OUT","msg":"DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()","origin":"rep","source_instance":"0","source_type":"APP","time":"2015-11-26T17:00:15Z","timestamp":1477069200012312311} 

I want to extract "msg" field's "value":

DEBUG --- [ Msync160670] c.c.internal.pmtdev.CacheUtilBean : :: Exiting Method ---\u003e com.internal.pmtdev.cache.fetchDataFromIndexedEventsDaily()
Tags (3)
0 Karma
1 Solution

Motivator
yourBaseQuery
|rex ".*,\"msg\":\"(?<message>.*)\",\"origin\""
| complete yourSearch

View solution in original post

Motivator
yourBaseQuery
|rex ".*,\"msg\":\"(?<message>.*)\",\"origin\""
| complete yourSearch

View solution in original post

Contributor

Is this what you're looking for?

 ... | rex field=_raw "msg\":\"(?P<msg>.[^\"\,\"]*)" | table msg

Appears to work for me:

alt text

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!