Searches separated by Colon

[ekucevic]

I source database that displays all of the info i need that is separated by colon. Example "ilruPartNumber":"12345"., "lruSoftwareVersion":"7.10.0.74". All of the info i need is separated by an " : "

What i want is to separate the search to list the Name then Number. Example ilruPartNumber = 12345.

[ITWhisperer]

| rex "\"(?<key>[^\"]+)\":\"(?<value>[^\"]+)\""
| eval {key}=value

[ekucevic]

Spoiler

I am a beginner here so alittle bit of a walk through could be necessary. 

[ITWhisperer]

The rex command (without a field argument) will operate on the _raw field of each event. The regex used extracts the part before the colon into a field called key and the part afterwards into a field called value. The eval command creates a field using the name in the key field and with the value from the value field. This is the basis for extracting the field. If you want a more precise version of the command, you should share some anonymised events, that you have already retrieved with your search, so the command can be tailored to your specific case.

[ekucevic]

Hi, Thanks for your reply, I think my issue is due to quotes within quotes? No sure. Below is a sample of my search. Basically everything in red is a sample what i am searching for. 

[{"lruName":"Modem","lruType":"MBR","lruMacAddress":"00:A0:BC:72:6F:44","lruModelNumber":"MBR-5500","lruSerialNumber":"C80016506037","lruPartNumber":"1244523","lruSoftwareVersion":"M3-1.3.5.2.89_2021.06.18","lruConfigVersion":"7.10.0.38"

[ITWhisperer]

This looks like JSON, perhaps you should investigate spath as a way to extract the fields