Splunk Search

Splunk Regex for Field Extraction

harish0557
Explorer

I want to extract fields from the below string(JSON) for:

eval time for each javascript (i.e require.min.js)
Load time for each javascript (i.e require.min.js)

Sample data:

"date":"2014-09-14T18:39:45.170Z","level":"INFO","logger":"marker.RESTART","seq":2,"msg":{"message":"load time in milliseconds","data":[{"moduleName":"node_modules/requirejs/require.min.js","startTimestamp":1442255975613,"fileSize":15330,"loadTime":752,"evalTime":27},{"moduleName":"buildjs/hnav.framework.js","startTimestamp":1442255975619,"fileSize":2443141,"loadTime":1737,"evalTime":2126},{"moduleName":"buildjs/hnav.index.js","startTimestamp":1442255975624,"fileSize":487047,"loadTime":950,"evalTime":456}],"packageType":"PROD"},"version":"0.5.10.12","clientIp":"192.168.1.10"}

Please help me with the regex for it

1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this. It will extract the modules and times into multi-value fields. It then combines the fields and breaks them into separate events.

...  | rex max_match=0 "\{\"moduleName\":\"(?P<module>[^\"]*).*?\"loadTime\":(?P<loadTime>\d+),\"evalTime\":(?P<evalTime>\d+)}" | eval fields = mvzip(mvzip(module,loadTime),evalTime) | mvexpand fields |...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this. It will extract the modules and times into multi-value fields. It then combines the fields and breaks them into separate events.

...  | rex max_match=0 "\{\"moduleName\":\"(?P<module>[^\"]*).*?\"loadTime\":(?P<loadTime>\d+),\"evalTime\":(?P<evalTime>\d+)}" | eval fields = mvzip(mvzip(module,loadTime),evalTime) | mvexpand fields |...
---
If this reply helps you, Karma would be appreciated.

skoelpin
SplunkTrust
SplunkTrust

Here's some untested regex which will work. Make sure to check the non-matches and see if there's anything left out

(?P<LoadTime>(?=\"loadTime\"\:)\d{2,6})
(?P<evalTime>(?=\"evalTime\"\:)\d{2,6})
0 Karma

harish0557
Explorer

but i want it for specific modules like - require.min.js , framework.js, index.js

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...