- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to write rex so command can extract the fields from json data?
manjunath_n
Engager
02-22-2022
01:21 PM
hello,
Please help me with the rex commands for extracting the below fields from the json data.
"resourceName" : "abcd",
"hostname" : "ipvalue",
"environment" : "development"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
02-22-2022
01:27 PM
| rex "resourceName\"\s:\s\"(?<resourceName>[^\"]+)\""
| rex "hostname\"\s:\s\"(?<hostname>[^\"]+)\""
| rex "environment\"\s:\s\"(?<environment>[^\"]+)\""
Alternatively, since it is JSON, why not use spath?
