Splunk Search

are we able to pick up everything between an open  [{ and  a close }]

Kisame27
Explorer

there is raw data :  [{}]

 parameters="[{"Name":"request","Type":"WithdrawalRequestedRequest","Value":{"BrandName":"Bumer","TransactionReference":"111403471","CustomerId":"00e9bc22-96ac-412f-90aa-a240dc03daf9","PaymentDetails":{"Created":"2021-11-18T06:56:54.377Z","Changed":"2021-11-18T06:56:54.393Z","Amount":25.0000,"Fee":0.2500,"CurrencyCode":"GEL","BaseAmount":7.0200,"BaseFee":0.0700,"BaseCurrencyCode":"EUR","PaymentMethodName":"BOG","PublicPaymentId":"t8185jta7fEBBOG","PaymentReference":"bf28bf9e-5caa-4faa-ba4f-c1422080f83e","ExternalData":null,"AdditionalParameters":null}}]" 

 

are we able to pick up everything between an open  [{ and  a close }]

the main Fields which I need mostly are: Amount , Base Amount  are you able to help me Please

Labels (1)
0 Karma

Kisame27
Explorer

thank you very much , have a good day

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\"\[\{(?<parameters>.*?)\}\]\""

Is this supposed to be JSON as the curly braces are mismatched?

scelikok
SplunkTrust
SplunkTrust

Hi @Kisame27 ,

The easiest way is removing [ and ] characters and using spath to extract all fields. Please try below;

| eval parameters=replace(replace(parameters,"\[",""),"\]","") 
| spath input=parameters
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...