Splunk Search

Need help with creating table and regex

New Member

{"line":{"log_type":"testlog","log_version":"1.0.0","service":"test","version":"1.0.0","timestamp":"2021-10-01T22:24:01.038Z","custom_data":{"info_to_log":"disneyworld {\"message\":\" Incorrect team id, cannot create relationship. \",\"status_code\":500}  \"{\\\"id\\\":\\\"fa351cd91130\\\",\\\"type\\\":\\\"test_add\\\",\\\"correlation_id\\\":\\\"e79ed142\\\",\\\"event_data\\\":{\\\"bar_id\\\":\\\"12312312\\\",\\\"mickeymouse_id\\\":\\\"12123212\\\",\\\"minniemouse_id\\\":\\\"121231\\\",\\\"disney_id\\\":\\\"1212312\\\",\\\"role\\\":\\\"cartoon\\\"}}\""},"level":"info","message":"disneyerror"},"source":"stdout","tag":"asawescw123"}

 

can anyone help with the query to create table where I can see the columns message (inside info_to_log), bar_id, mickeymouse_id, minniemouse_id  

Labels (2)
0 Karma

Influencer

@irshtnak 

if all the escaped quoting is as in the event, then see this example using your data

| makeresults
| eval _raw="{\"line\":{\"log_type\":\"testlog\",\"log_version\":\"1.0.0\",\"service\":\"test\",\"version\":\"1.0.0\",\"timestamp\":\"2021-10-01T22:24:01.038Z\",\"custom_data\":{\"info_to_log\":\"disneyworld {\\\"message\\\":\\\" Incorrect team id, cannot create relationship. \\\",\\\"status_code\\\":500}  \\\"{\\\\\\\"id\\\\\\\":\\\\\\\"fa351cd91130\\\\\\\",\\\\\\\"type\\\\\\\":\\\\\\\"test_add\\\\\\\",\\\\\\\"correlation_id\\\\\\\":\\\\\\\"e79ed142\\\\\\\",\\\\\\\"event_data\\\\\\\":{\\\\\\\"bar_id\\\\\\\":\\\\\\\"12312312\\\\\\\",\\\\\\\"mickeymouse_id\\\\\\\":\\\\\\\"12123212\\\\\\\",\\\\\\\"minniemouse_id\\\\\\\":\\\\\\\"121231\\\\\\\",\\\\\\\"disney_id\\\\\\\":\\\\\\\"1212312\\\\\\\",\\\\\\\"role\\\\\\\":\\\\\\\"cartoon\\\\\\\"}}\\\"\"},\"level\":\"info\",\"message\":\"disneyerror\"},\"source\":\"stdout\",\"tag\":\"asawescw123\"}"
| spath input=_raw line.custom_data
| rex field=line.custom_data "message..:..(?<message>[^\\\]*).*bar_id[^\d]*(?<bar_id>\d+).*mickeymouse_id[^\d]*(?<mickeymouse_id>\d+).*minniemouse_id[^\d]*(?<minniemouse_id>\d+)"
| table message bar_id mickeymouse_id minniemouse_id
| eval message=trim(message)

It uses spath to get the custom_data field then uses rex against that to extract the fields. It assumes the fields will be in the order wanted, if not, then you will have to adjust the rex.

Hope this helps

 

 

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!