Splunk Search

How to write rex so command can extract the fields from json data?

manjunath_n
Engager

hello,

Please help me with the rex commands for extracting the below fields from the json data.

"resourceName" : "abcd",
"hostname" : "ipvalue",
"environment" : "development"

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| rex "resourceName\"\s:\s\"(?<resourceName>[^\"]+)\""
| rex "hostname\"\s:\s\"(?<hostname>[^\"]+)\""
| rex "environment\"\s:\s\"(?<environment>[^\"]+)\""

Alternatively, since it is JSON, why not use spath?

 

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...