Hi All, I want to extract email from json event in splunk. Query I am using is : index=*sec sourcetype=test
| eval tags_json=spath(_raw, "Tag{}"), final_tag_json=json_object()
| foreach...
See more...
Hi All, I want to extract email from json event in splunk. Query I am using is : index=*sec sourcetype=test
| eval tags_json=spath(_raw, "Tag{}"), final_tag_json=json_object()
| foreach mode=multivalue tags_json [ | eval final_tag_json=json_set(final_tag_json, spath('<<ITEM>>', "Key"), spath('<<ITEM>>', "Value"))]
| spath input=final_tag_json
| rex field=Email "(?<email>^\w+@abc.com$)" Raw data : "Tag": [{"Key": "app", "Value": “test”_value}, {"Key": "key1", "Value": "value1"}, {"Key": "key2", "Value": "value2"}, {"Key": “email”, "Value": “test@abc.com}], I want email to be mapped to contact when indexed. How can I achieve this ? Please help me Regards, pnv