{\"reference_id\":\"REF1\",\"sub_reference_id\":\"sub_ref_1\"}
required output : table of reference_id, sub_reference_id
For the above search string :
I am trying :
rex field=_raw "reference_id\\\\":\\\\"(?P<reference_id>.P[^\"]*)"
But it is not working. can someone help with the correct rex command to extract the fields explicitely
index=_internal | head 1 | fields _raw
| eval _raw="{\\\"reference_id\\\":\\\"REF1\\\",\\\"sub_reference_id\\\":\\\"sub_ref_1\\\"}"
| rename COMMENT as "this is sample"
| rex mode=sed "s/\\\//g"
| spath
try rex with sed mode and spath.
First two lines set up your example data - main line extracts the two values into the fields
| makeresults
| eval _raw="{\\\"reference_id\\\":\\\"REF1\\\",\\\"sub_reference_id\\\":\\\"sub_ref_1\\\"}"
| rex field=_raw "reference_id\\\\\":\\\\\"(?P<reference_id>[^\\\\\"]*)\\\\\",\\\\\"sub_reference_id\\\\\":\\\\\"(?P<sub_reference_id>[^\\\\\"]*)"
| makeresults
| eval _raw="{\\\"reference_id\\\":\\\"REF1\\\",\\\"sub_reference_id\\\":\\\"sub_ref_1\\\"}"
| rex field=_raw "reference_id\\\\\":\\\\\"(?P<reference_id>[^\\\\\"]*)"
The value is not a constant string. Hence, need a query that fetches the value dynamically.
That rex statement is exactly that - extracting the dynamic reference - the REF1 is your example data showing how it works