Splunk rex help

[jabez2092]

I need help for extracting the below fields. can someone help..

reference = 205, \"sample\":12345678, \"logic\":\"AB000012\", \"status\":0, \"result_message\":null, \"end_time\":null,

sample=12345678

logic=AB000012

status=0

result_message=null

end_time=null

[johnhuang]

Here's a quick and lazy way -- may not be the best solution.

| makeresults
| eval sample_string="reference = 205, \\\"sample\\\":12345678, \\\"logic\\\":\\\"AB000012\\\", \\\"status\\\":0, \\\"result_message\\\":null, \\\"end_time\\\":null,"
| eval _raw=sample_string
| rex field=_raw "reference\s\=\s\d+,\s(?<_raw>.*)"
| rex field=_raw mode=sed "s/\\\\\"//g"
| extract kvdelim=":" pairdelim=","
| table sample_string sample logic status result_message end_time

[jabez2092]

@johnhuang Thank you. But the values quoted as "  are dynamic actually. I need to have it as 

 | table sample,logic,status,result_message,end_time

sample="12345678"

logic="AB000012"

status="0"

result_message="null"

end_time="null"

Basically if im able to able to extract these fields (sample, logic, status, result_message, end_time) I can proceed further.

[isoutamo]

Hi

if reference is always here, you could try this

index=_internal 
| head 1
| eval _raw="reference = 205, \\\"sample\\\":12345678, \\\"logic\\\":\\\"AB000012\\\", \\\"status\\\":0, \\\"result_message\\\":null, \\\"end_time\\\":null,"
| rex "reference\s+=\s+(?<reference>\d+),\s+(?<json>.*)"
| rex mode=sed field=json "s/\\\\\"/\"/g"
| rex mode=sed field=json "s/(.*),$/{\1}/"
| spath input=json
| table reference json sample logic status result_message end_time

Now it takes reference out and then transfer rest of event to json. Then You can manage individual elements after spath command as you want independent what are those names. This expecting that there is "," on last character on event. If not then you must change that last rex command to handle those.

r. Ismo