Regex help

[msn2507]

can somebody help on how to import the log file of the below format to splunk ?

{"Error":[{"session":abc123,"app_id":12345,"error_reason":700,"app_version:"1.0"},{{"session":abc345,"app_id":67890,"error_reason":123,"app_version:"1.0"},{{"session":abc678,"app_id":123789,"error_reason":701,"app_version:"1.1"},"status":"success","current_page":1,"per_page":100,"total_entries":3,"total_pages":1}

[kristian_kolb]

See these docs pages.

http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/Aboutgettingdatain
http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

since you don't seem to have a timestamp in your events, you'd probably need to set DATETIME_CONFIG = CURRENT in props.conf for your sourcetype.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

As for field extraction, the command spath can be used to extract fields from JSON-formatted data (which is what that looks like).

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Spath

Hope this helps,

K