Splunk rex query to filter message

Question

I have a splunk log in the below format:

{"Apple":
    {"message":"abcdefgh.ijkl","code":"200"}
}

I want to filter the message "abcdefgh.ijkl" and code separately.

Would You be so kind and update Your question in reproducible and verifiable manner. Just like [MCVE](https://stackoverflow.com/help/mcve) describes. — Kamiccolo, Mar 20 '19 at 14:52
in the log that I said in question will come as message_text: {} — Sateesh M, Mar 20 '19 at 14:52
this is how i get the log. message_text: {"data": {"message":"I'm a Developer.Lives in Hyderabad","code":"200"} } — Sateesh M, Mar 20 '19 at 14:53

score 0 · Answer 1 · answered Mar 20 '19 at 17:46

0

Try this rex command in your query.

... | rex "message\":\"(?<message>[^\"]+)\",\"code\":\"(?<code>\d+)" | ...

answered Mar 20 '19 at 17:46

RichG

1 Answers1