@anooshac Can you please try this? | makeresults
| eval _raw="{
\"Info\": {
\"Unit\": \"ABC\",
\"Project\": \"XYZ\",
\"Analysis Summary\": {
\"DB1\": {
\"Available\": 1088,
\"Used\": 173.23,
\"Used(%)\": 15.92,
\"Status\": \"OK\"
},
\"DB2\": {
\"Available\": 4096,
\"Used\": 1591.85,
\"Used(%)\": 38.86,
\"Status\": \"OK\"
},
\"DB3\": {
\"Available\": 128,
\"Used(%)\": 2.6,
\"Status\": \"OK\"
},
\"DB4\": {
\"Available\": 16500,
\"Used\": 6696.0,
\"Used(%)\": 40.58,
\"Status\": \"OK\"
},
\"DB5\": {
\"Available\": 22000,
\"Used\": 9800.0,
\"Used(%)\": 44.55,
\"Status\": \"OK\"
}
}
}
}"
| rex field=_raw mode=sed "s/(\n\s+)//g" max_match=0
| rex field=_raw mode=sed "s/(^.*\"Analysis Summary\"\: )//g" max_match=0
| rex field=_raw mode=sed "s/(,\"RAM_Tracking.*)//g" max_match=0
| rex field=_raw "\"(?<Database>[^\"]+)\": \{\"Available" max_match=0
| rex field=_raw ":\s?(?<Data>\{.+?})" max_match=0
| eval tmp = mvzip(Database,Data,"|")
| mvexpand tmp
| eval Database=mvindex(split(tmp,"|"),0), Data=mvindex(split(tmp,"|"),1)
| rex field=Data "{\"Available\"\:\s?\"?(?<available>[^,]+)\"?,(\"Used\"\:\s?\"?(?<used>[^,]+)\"?,)?\"Used\(%\)\"\:\s?\"?(?<used_p>[^,]+)\"?,\"Status\"\:\s?\"(?<status>[^}]+)\"}"
| table Database available used used_p status Incase still not working then, remove all statements and try adding them one by one to check at which point its breaking. Thanks KV If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.
... View more