Splunk Search

how to extract fields from json format event?

nehamvinchankar
Path Finder

Hi all, i want to extract fields from event which is in json format

INFO [processor: anchsdgeiskgcbc/5; event: 1-57d28402-9058-11ee-83b7-021a6f9d1f1c] : DETAILS: [
{
"ERROR_MESSAGE": "\nError: abchdvshsuaajs.\n",
"NUMBER": "123r57",
"DB_TIMESTAMP": "2023-11-30"
},
{
"ERROR_MESSAGE": "\nError: ehwegagsuabajehss.\n",
"NUMBER": "63638w82u",
"DB_TIMESTAMP": "2023-11-30"
},

and similarly we have these error data in one event

Fields to be extracted -
ERROR_MESSAGE
NUMBER
DB_TIMESTAMP




Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that this doesn't appear to be wholly correct JSON, you could start with something like this

| rex "DETAILS: (?<details>\[.*\])"
| spath input=details 
0 Karma

nehamvinchankar
Path Finder

no this is not working

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What results do you get then?

0 Karma

nehamvinchankar
Path Finder

nehamvinchankar_0-1701833361480.png

details field is blank

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| rex "(?ms)DETAILS: (?<details>\[.*\])"
| spath input=details 
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...