Splunk Search

regex question

dbautist
Explorer

I have the following log snippet with a JSON payload that includes a newline. How do I extract the entire JSON payload?

ID: 123
Payload: {
"info":{
"name":"bob",
"age":"35"
}
}

Expected field should contain:

{
"info":{
"name":"bob",
"age":"35"
}
}

Tags (1)
0 Karma
1 Solution

aholzer
Motivator

This should do the trick for you:

Payload: (?P<YourField>[^\}]+\}){2}

Assuming that all your payloads only have 2 close curly brackets '}'

Use the "interactive field extractor" view to test the regex before applying it (run your search > click the blue box next to one of the events > select "Extract Fields")

EDIT:

Change the value {2} from my above code to match the number of "closing curly brackets" '}' in your payload to have the regex work.

View solution in original post

0 Karma

aholzer
Motivator

This should do the trick for you:

Payload: (?P<YourField>[^\}]+\}){2}

Assuming that all your payloads only have 2 close curly brackets '}'

Use the "interactive field extractor" view to test the regex before applying it (run your search > click the blue box next to one of the events > select "Extract Fields")

EDIT:

Change the value {2} from my above code to match the number of "closing curly brackets" '}' in your payload to have the regex work.

0 Karma

aholzer
Motivator

As long as the number of "closing curly brackets" '}' is consistent across all your payloads, just count them and then change the {2} from my original post to the new number.

So in your latest example the {2} should be changed to a {4}.

0 Karma

dbautist
Explorer

That's actually not the case. I have something like:

{
"test":{
"a":"b"
"c":{
"d":"e"
}
}
"e":{
"f":"g"
}
}

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...