How to write rex so command can extract the fields... - Splunk Community

Splunk Search

hello,

Please help me with the rex commands for extracting the below fields from the json data.

"resourceName" : "abcd",
"hostname" : "ipvalue",
"environment" : "development"

| rex "resourceName\"\s:\s\"(?<resourceName>[^\"]+)\""
| rex "hostname\"\s:\s\"(?<hostname>[^\"]+)\""
| rex "environment\"\s:\s\"(?<environment>[^\"]+)\""

Alternatively, since it is JSON, why not use spath?

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...