I source database that displays all of the info i need that is separated by colon. Example "ilruPartNumber":"12345"., "lruSoftwareVersion":"7.10.0.74". All of the info i need is separated by an " : "
What i want is to separate the search to list the Name then Number. Example ilruPartNumber = 12345.
| rex "\"(?<key>[^\"]+)\":\"(?<value>[^\"]+)\""
| eval {key}=value
The rex command (without a field argument) will operate on the _raw field of each event. The regex used extracts the part before the colon into a field called key and the part afterwards into a field called value. The eval command creates a field using the name in the key field and with the value from the value field. This is the basis for extracting the field. If you want a more precise version of the command, you should share some anonymised events, that you have already retrieved with your search, so the command can be tailored to your specific case.
Hi, Thanks for your reply, I think my issue is due to quotes within quotes? No sure. Below is a sample of my search. Basically everything in red is a sample what i am searching for.
[{"lruName":"Modem","lruType":"MBR","lruMacAddress":"00:A0:BC:72:6F:44","lruModelNumber":"MBR-5500","lruSerialNumber":"C80016506037","lruPartNumber":"1244523","lruSoftwareVersion":"M3-1.3.5.2.89_2021.06.18","lruConfigVersion":"7.10.0.38"
This looks like JSON, perhaps you should investigate spath as a way to extract the fields