rex json field extraction

[togmolodon]

Splunk newbie here.

I need to extract fields from our JSON logs, sample _raw output below:

2014-01-22 21:25:33,802 [xid=,fn=] INFO [pool-9-thread-1] tion.rts.RTSConsumer | Processing RTS JSON=RTSJsonEvent{value(m)='279732640,CardYellowHome,0104400000|279736050,CardYellowHome,0304000000|279738003,GoalHome,0404000000|279745927,GoalHome,0593900000', match id(t)='123456', type id(tp)='112', key(k)='CardYellowHome,No Player|CardYellowHome,No Player|GoalHome,No Player|GoalHome,No Player', parent id(p)='', id(i)='279746011', servertime='2014-01-23 02:25:33.619'}

I want the output in table format wherein it contains the values for match id, type id, key, parent id, id, and server time.

Thanks for the help.

[MuS]

Hi togmolodon,

no need to extract fields by rex, just use the spath search command on your JSON logs and you're ready to build your table. See example #3 in the docs about spath.

hope this helps ...

cheers, MuS

[togmolodon]

My head seemed out of whacked lately, I can't even make the rename function to work. I started out with the following:

host="172.16.1.1" "Processing RTS JSON=" | spath | rename RTSJsonEvent.value{1}{@value} AS "Game Timer" | table "Game Timer"

The above did not return any.