Splunk Search

How to use substr or regex to extract part of text

vvkarur
New Member

I have string like this , {"code":"1234","bday":"15-02-06T07:02:01.731+00:00" "name":"Alex", "role":"student","age":"16"}, and I want to extract role from this string. Can any one suggest way in splunk logs? 

Labels (3)
0 Karma

smanojkumar
Contributor

Hello @vvkarur ,

You can try this regex

| rex field=_raw  "\"role\":\"(?<field_name>\w+)\""

Thanks!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

As @ITWhisperer points out, neither substring or regex is the correct tool to extract information from structured data such as JSON.  I assume that that so-called "string" is not the entire event because otherwise Splunk would have automatically extracted role at search time.  Suppose you have an event like this (I'm quite convinced that you missed a comma between '00"' and '"name'.)

 

stuff before ...  {"code":"1234","bday":"15-02-06T07:02:01.731+00:00", "name":"Alex", "role":"student","age":"16"} stuff after ...

 

What you do is to use regex to extract the part that is compliant JSON (not a portion of it), then use spath or fromjson to extract all key-value pairs.

The following should usually work:

 

| rex "^[^{]*(?<json_message>{.+})"
| spath input=json_message

 

That sample data will return

agebdaycodejson_messagenamerole
1615-02-06T07:02:01.731+00:001234{"code":"1234","bday":"15-02-06T07:02:01.731+00:00", "name":"Alex", "role":"student","age":"16"}Alexstudent

Here is an emulation for you to play with and compare with real data

 

| makeresults
| eval _raw = "stuff before ...  {\"code\":\"1234\",\"bday\":\"15-02-06T07:02:01.731+00:00\", \"name\":\"Alex\", \"role\":\"student\",\"age\":\"16\"} stuff after ..."
``` data emulation above ```

 

Tags (1)
0 Karma

luizlimapg
Path Finder

Hi @vvkarur 

You can use the rex field, like this example.

| rex field=_raw "\"role\"\:\"(?<role>[^,\"]+)\""

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This looks like JSON so you should ingest it as such. Alternatively, you could use spath to extract the fields. Alternatively, look at the json functions.

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...