Splunk Search

How to write rex so command can extract the fields from json data?

manjunath_n
Engager

hello,

Please help me with the rex commands for extracting the below fields from the json data.

"resourceName" : "abcd",
"hostname" : "ipvalue",
"environment" : "development"

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| rex "resourceName\"\s:\s\"(?<resourceName>[^\"]+)\""
| rex "hostname\"\s:\s\"(?<hostname>[^\"]+)\""
| rex "environment\"\s:\s\"(?<environment>[^\"]+)\""

Alternatively, since it is JSON, why not use spath?

 

0 Karma
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...