Parsing string with whitespaces as json object

[mipa04]

Hi, I am completely new to splunk and have to parse field that looks like this:
params="['field1: value1', 'field2: value2', 'field3: value3']" (note spaces after colons) - I have to extract field1, field2, field3 to be searchable - can you help with what query should I write?

[yuanliu · Accepted solution]

Like @ITWhisperer said, this is not JSON.  AND a strange choice of data format.  How to extract what you need depends quite on string values of "field1" "field2", "value1", "value2", etc.  If none of "fieldN", "valueN" contains hard breakers such as white space, you do something as simple as

| rex mode=sed field=params "s/: */=/g"
| rename _raw as temp, params AS _raw
| kv
| rename temp AS _raw

(I assume that you already have the field params.)

If the data is more complex than that, you will need to reconstruct data.  One way is to convert the structure into conformant JSON.  For example,

| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

Here is a complete emulation

| makeresults
| fields - _*
| eval params = "['field1: value1', 'field2: value2', 'field3: value3']"
| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

field1	field2	field3	params
value1	value2	value3	{"field1":"value1", "field2":"value2", "field3":"value3"}

[ITWhisperer]

That isn't a JSON object, so you could try using rex to parse it - you could try something like this

| rex max_match=0 "'(?<field>\w+:\s[^']+)'"
| mvexpand field
| rex field=field "(?<name>\w+):\s(?<value>.*)"
| eval {name} = value
| fields - name value
| stats values(*) as * by _raw