Splunk Search

Splunk query to extract json key value

sahuask
Loves-to-Learn

Please help to extract payload data from logs entries and extract the PlatformVersion and PlatformClient values. Need in python code.

Log Entries: 

"tracking~2015~526F3D98","2015:1302",164,1,"2022-02-07 11:10:08.744 INFO [threadPoolTaskExecutorTransformed5 - ?] saving event to log =core-server-event-tracking-api, payload={""PlatformVersion"":""6.34.36 - 4.18.6"",""PlatformClient"":""html""},53
"tracking~2015~526F3D98","2015:130",164423,1,"2022-02-07 11:10:08.744 INFO [threadPoolTaskExecutorTransformed5 - ?] saving event to log =core-server-event-tracking-api, payload={""PlatformVersion"":""6.34.37 - 4.18.7"",""PlatformClient"":""xml""},54

 

Thanks

Labels (1)
Tags (2)
0 Karma

johnhuang
Motivator

Regex:

payload\=\{\"+PlatformVersion[\"\:]*(?<platform_ver>[^\"]*)[\"\,"]*(?<platform_client>[^\"]*)\"

0 Karma

sahuask
Loves-to-Learn

Thanks @johnhuang . 

I am using python and im getting error- Mismatched ']'. 

Can you please provide me the python version of this regex. Thanks

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @sahuask 

You shall be bit more specific, the SH automatically extract the JSON fields automatically if props.conf having correct settings.

What you mentioned was about python code,  meaning how you going to read the data in python code? 
probably API?

0 Karma

sahuask
Loves-to-Learn

I dont have the control for the configuration setting. the ask is to extract from the log entries as text.

Yes, I need a to use splunk api in python code.

 

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...