Splunk Search

extract message field from JSON

Esky73
Builder

trying to extract the msg field from an azure blob which uses the _json sourcetype - the msg : field shows as one long field - how to extract this please ?

msg: 2018-07-10T06:53:42.803Z email|5b3c37d::Rules::ValidateUser:: ::BEGIN-RULE::
Validate - user {"_id":"25fd57973c","email":"blah@hotmail.com","email_verified":true,"clientID":"8NReZXmds4","updated_at":"2018-07-10T06:53:42.764Z","name":"blah@hotmail.com","picture":"https://web.png","user_id":"email|5b3c37dd","nickname":"nickname","identities":[{"user_id":"5b3c3","provider":"email","connection":"email","isSocial":false}],"created_at":"2018-07-04T02:58:55.014Z","user_metadata":{"firstname":"bob","lastname":"bob","name":"bob bob"},"global_client_id":"rEJsAkwGVI","app_metadata":{"client_info":{"MyAccount":{"first_login_time":"2018-07-04T02:58:55.422Z","count":7,"last_login_time":"2018-07-10T06:49:40.126Z","user_id":"a0uid_xxxxx"}}},"client_info":{"MyAccount":{"first_login_time":"2018-07-04T02:58:55.422Z","count":7,"last_login_time":"2018-07-10T06:49:40.126Z","user_id":"a0uid_46"}},"persistent":{}}

thanks

*** UPDATE ***

So i've made some progress where i can create a new_msg field stripping off the non-json part of the msg field :

2018-07-10T06:53:42.803Z email|5b3c37d::Rules::ValidateUser:: ::BEGIN-RULE::Validate - user

and then that allows me to run spath on the new_msg

| rex field=msg "^[^{]+(?<new_msg>.*)" | spath input=new_msg

now my field count has gone from ~50 to 500+

Is there a better way ?

0 Karma

manish_singh_77
Builder

Pls try this in your search and let me know..

extract pairdelim=",", kvdelim='":"'

0 Karma

manish_singh_77
Builder

You can also use the below mentioned regex, there are two regex, one captures everything after msg and other captures only till email, try this and let me know if it works for you.

yourBaseQuery
|rex "\msg:\s+(?.*)"
| complete your search

yourBaseQuery
| rex \msg:\s+(?\w+-\w+-\w+:\w+:\w+.\w+\s+\w+)
| complete your search

0 Karma

Esky73
Builder

both of these errored with Regex: unrecognized character follows \

I have updated my progress above. TY

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...