Splunk Search

extract json from string

ashodha
Engager

hi, I have a string int the following format:

msg: Logging interaction event { eventId: '12dea8c0-dfb2-4988-9e97-314dd6243918', eventAction: 'Failed', eventType: '123event', eventSubtype: '1234eventsub', domainName: 'common', appName: 'authentication', containerName: 'root', containerVersion: '0.0.973' }

i am unable to extract eventType and eventSubtype   because of text "Logging interaction event" how cna i get rid of this text and extract these fields

 

 

Labels (3)
0 Karma
1 Solution

ericjorgensenjr
Path Finder

This should work:

 

| rex field=msg "(?<json>{[^\}]+})" | eval json=replace(replace(json,"(\w+):","\"\1\":"),"'([^']+)'","\"\1\"") | spath input=json

View solution in original post

Tags (1)

ericjorgensenjr
Path Finder

This should work:

 

| rex field=msg "(?<json>{[^\}]+})" | eval json=replace(replace(json,"(\w+):","\"\1\":"),"'([^']+)'","\"\1\"") | spath input=json
Tags (1)

richgalloway
SplunkTrust
SplunkTrust

I like the way you fixed the quoting in the json.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can use the rex command to strip out the undesired text, but I doubt it will help.  This example query still fails.

| makeresults 
| eval _raw="msg: Logging interaction event { eventId: '12dea8c0-dfb2-4988-9e97-314dd6243918', eventAction: 'Failed', eventType: '123event', eventSubtype: '1234eventsub', domainName: 'common', appName: 'authentication', containerName: 'root', containerVersion: '0.0.973' }" 
| rex "(?<field2>\{[\s\S]+})" 
| spath input=field2

The search log reports:

WARN  SPathCommand - Some events are not in XML or JSON format.  Fields will not be extracted from these events.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...