Regex Expressions

[anandhalagarasa]

Hi Team,

I need to extract the fields from the JSON format in my Search Head GUI so kindly let us know how to proceed further.

{ [-]
id:

message: 2018-10-11 10:33:46,879 [44] |INFO|Access=abcdef|Max=(abcd)|Data=(xyz)|Fox=(ghi)|Mach=(pqrs)|Bend=(uvw)| http://amazon.com.local:098765/dam/healthchecks/band

 severity:   INFO   

}

Need to extract fields in the form of Regex:

Date:2018-10-11 10:33:46,879
Level=INFO
Access=abcdef
Max=(abcd)
Fox=(ghi)
Mach=(pqrs)
Bend=(uvw)
Message=http://amazon.com.local:098765/dam/healthchecks/band

Once the fields are extracted if we click Max on the left hand side it needs to show abcd

So kindly help on this to make up a regex so that i can able to implement the same and extract those fields.

[skoelpin]

If its already in Splunk and you want to extract at search-time, you will then need to get crafty with spath

https://answers.splunk.com/answers/642304/how-can-i-extract-the-json-data-as-key-value-pair.html

[kmorris_splunk]

Could you re-paste your sample? It seems like you may have formatted part of it as code using the 101010 button.

[anandhalagarasa]

Kindly help on this request.

[inventsekar]

you want to extract the fields from the logs which are already ingested or you want to setup props/transforms, so that the future logs will be automatically extracted?!?!

[anandhalagarasa]

I want to extract the fields which is already getting ingested into Splunk and they are in JSON format. And I want to extract in GUI using Regex expressions.

[anandhalagarasa]

Kindly help