Splunk Search

Unable to query on multiple extracted fields

sivathemass
Engager

I've  a log like below and I want to extract the fields "country", "currency"

"{"id":1, "message":"country=US&currency=USD"}.


I wrote SPL 
index="main"| rex max_match=0 field=message "(?<key>\w+)=(?<value>[^&]+)" | eval z=mvzip(key, value, "~") | mvexpand z | rex field=z "(?<key>[^~]+)~(?<value>.*)" | eval {key} = value

After extracting the fields, I can search based on only one field. 
This works .
index="main"| rex max_match=0 field=message "(?<key>\w+)=(?<value>[^&]+)" | eval z=mvzip(key, value, "~") | mvexpand z | rex field=z "(?<key>[^~]+)~(?<value>.*)" | eval {key} = value | search country=US 

This does not work
index="main"| rex max_match=0 field=message "(?<key>\w+)=(?<value>[^&]+)" | eval z=mvzip(key, value, "~") | mvexpand z | rex field=z "(?<key>[^~]+)~(?<value>.*)" | eval {key} = value | search country="US" AND currency="USD". 

It yields 0 results
Any pointers please? 

 

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults 
| eval _raw="{\"id\":1, \"message\":\"country=US&currency=USD\"}"
| spath
| spath message output=message
| rename message as _raw
| extract

rename to _raw is trick.

View solution in original post

to4kawa
Ultra Champion
| makeresults 
| eval _raw="{\"id\":1, \"message\":\"country=US&currency=USD\"}"
| spath
| spath message output=message
| rename message as _raw
| extract

rename to _raw is trick.

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...