Please help to extract payload data from logs entries and extract the PlatformVersion and PlatformClient values. Need in python code.
Log Entries:
"tracking~2015~526F3D98","2015:1302",164,1,"2022-02-07 11:10:08.744 INFO [threadPoolTaskExecutorTransformed5 - ?] saving event to log =core-server-event-tracking-api, payload={""PlatformVersion"":""6.34.36 - 4.18.6"",""PlatformClient"":""html""},53
"tracking~2015~526F3D98","2015:130",164423,1,"2022-02-07 11:10:08.744 INFO [threadPoolTaskExecutorTransformed5 - ?] saving event to log =core-server-event-tracking-api, payload={""PlatformVersion"":""6.34.37 - 4.18.7"",""PlatformClient"":""xml""},54
Thanks
Regex:
payload\=\{\"+PlatformVersion[\"\:]*(?<platform_ver>[^\"]*)[\"\,"]*(?<platform_client>[^\"]*)\"
Thanks @johnhuang .
I am using python and im getting error- Mismatched ']'.
Can you please provide me the python version of this regex. Thanks
Hi @sahuask
You shall be bit more specific, the SH automatically extract the JSON fields automatically if props.conf having correct settings.
What you mentioned was about python code, meaning how you going to read the data in python code?
probably API?
I dont have the control for the configuration setting. the ask is to extract from the log entries as text.
Yes, I need a to use splunk api in python code.