Splunk Search

parse and index json fields from string message

vashodha
Loves-to-Learn Lots

Hello,

I have log in the format 

"2021-02-18T16:17:12,189Z [main] INFO logname -streamstart-k1:V1,K2:V2,K3:V3,streamstop, <ADDIITONAL DATA>"  i want to parse out json elements k1:v1 etc thats between  "-streamstart" and streamstop

Labels (1)
0 Karma

b4badri
New Member

Try this

rex "streamstart(?<myvariable>(.*)(?=streamstop))"

 

0 Karma

vashodha
Loves-to-Learn Lots

it does the job but still dosent index the fields its extracted it out to the variable  can we somehow index these csv values

0 Karma

vashodha
Loves-to-Learn Lots

This gives me what i want but i am unable to index it in splunk 

(?<=streamstart-).*?(?=streamstop)

0 Karma

b4badri
New Member

Hi @vashodha 

Yes. Data extracted using rex in the search time will only be available for the search. You need to follow series of steps based on your Splunk solution for creating fields at Index time.

Please refer the below article.

Create custom fields at index time - Splunk Documentation

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...