Splunk Search

Splunk Regex for Field Extraction

harish0557
Explorer

I want to extract fields from the below string(JSON) for:

eval time for each javascript (i.e require.min.js)
Load time for each javascript (i.e require.min.js)

Sample data:

"date":"2014-09-14T18:39:45.170Z","level":"INFO","logger":"marker.RESTART","seq":2,"msg":{"message":"load time in milliseconds","data":[{"moduleName":"node_modules/requirejs/require.min.js","startTimestamp":1442255975613,"fileSize":15330,"loadTime":752,"evalTime":27},{"moduleName":"buildjs/hnav.framework.js","startTimestamp":1442255975619,"fileSize":2443141,"loadTime":1737,"evalTime":2126},{"moduleName":"buildjs/hnav.index.js","startTimestamp":1442255975624,"fileSize":487047,"loadTime":950,"evalTime":456}],"packageType":"PROD"},"version":"0.5.10.12","clientIp":"192.168.1.10"}

Please help me with the regex for it

1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this. It will extract the modules and times into multi-value fields. It then combines the fields and breaks them into separate events.

...  | rex max_match=0 "\{\"moduleName\":\"(?P<module>[^\"]*).*?\"loadTime\":(?P<loadTime>\d+),\"evalTime\":(?P<evalTime>\d+)}" | eval fields = mvzip(mvzip(module,loadTime),evalTime) | mvexpand fields |...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this. It will extract the modules and times into multi-value fields. It then combines the fields and breaks them into separate events.

...  | rex max_match=0 "\{\"moduleName\":\"(?P<module>[^\"]*).*?\"loadTime\":(?P<loadTime>\d+),\"evalTime\":(?P<evalTime>\d+)}" | eval fields = mvzip(mvzip(module,loadTime),evalTime) | mvexpand fields |...
---
If this reply helps you, Karma would be appreciated.

skoelpin
SplunkTrust
SplunkTrust

Here's some untested regex which will work. Make sure to check the non-matches and see if there's anything left out

(?P<LoadTime>(?=\"loadTime\"\:)\d{2,6})
(?P<evalTime>(?=\"evalTime\"\:)\d{2,6})
0 Karma

harish0557
Explorer

but i want it for specific modules like - require.min.js , framework.js, index.js

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...