I need to extract the highlighted field in the below messege using regex... Not only do you not NEED to do this using regex, you MUST NOT use regex for this task. As @ITWhisperer points out, yo...
See more...
I need to extract the highlighted field in the below messege using regex... Not only do you not NEED to do this using regex, you MUST NOT use regex for this task. As @ITWhisperer points out, your data is in JSON, a structured data. Never treat structured data as plain text as @PickleRick points out. As @PickleRick notes, you can set KV_MODE = json in your sourcetype. But even if you do not, Splunk should have already figured out and give you CrmId, status, source, etc. Do you not get these field names and values? field name field value CrmId 11111111 SiteId xxxx applicationReceivedDate assignmentStatus assignmentStatusCode c4cEventId cancelReason category Course Enquiry channelPartnerApplication no createdBy Technical User eventId eventRegistrationId eventTime 2024-06-24T06:15:42Z externalId isFirstLead yes lastChangedBy Technical User leadId 22222222 leadSubAgentID leaduuid 1234455 referredBy referrerCounsellor source Online Enquiry status Open studentCrmUuid 634543564 subCategory Even if you do not for some oddball reason, using spath should suffice. This is an example with spath using @ITWhisperer's makeresults emulation. | makeresults
| eval _raw="{ \"eventTime\": \"2024-06-24T06:15:42Z\", \"leaduuid\": \"1234455\", \"CrmId\": \"11111111\", \"studentCrmUuid\": \"634543564\", \"externalId\": \"\", \"SiteId\": \"xxxx\", \"subCategory\": \"\", \"category\": \"Course Enquiry\", \"eventId\": \"\", \"eventRegistrationId\": \"\", \"status\": \"Open\", \"source\": \"Online Enquiry\", \"leadId\": \"22222222\", \"assignmentStatusCode\": \"\", \"assignmentStatus\": \"\", \"isFirstLead\": \"yes\", \"c4cEventId\": \"\", \"channelPartnerApplication\": \"no\", \"applicationReceivedDate\": \"\", \"referredBy\": \"\", \"referrerCounsellor\": \"\", \"createdBy\": \"Technical User\", \"lastChangedBy\": \"Technical User\" , \"leadSubAgentID\": \"\", \"cancelReason\": \"\"}, \"offersInPrinciple\": {\"offersinPrinciple\": \"no\", \"oipReferenceNumber\": \"\", \"oipVerificationStatus\": \"\"}, \"qualification\": {\"qualification\": \"Unqualified\", \"primaryFinancialSource\": \"\"}, \"online\": {\"referringUrl\": \"\", \"idpNearestOffice\": \"\", \"sourceSiteId\": \"xxxxx\", \"preferredCounsellingMode\": \"\", \"institutionInfo\": \"\", \"courseName\": \"\", \"howDidYouHear\": \"Social Media\"}"
``` ITWhisperer's data emulation ```
| spath It gives the above field names and values.