1

I have a json log as shown below 

{
action: Get, 
applicationName: abc,
controller: Main, 
ip: 123.123.123.123, 
logLevel: INFO, 
loggerType: abcdef, 
machineName: windows, 
message: {"Value":{"Data":{"Items":[{"FieldType":"abc","Value":""},{"FieldType":"abcd","Value":""},{"FieldType":"123","Value":""}],"EncryptedDocKey":"123456","Domain":"Order","Partner":"India","Carrier":"Idea"},"RequestTrackerId":"7894561230","Message":"OK"},"Formatters":[],"ContentTypes":[],"DeclaredType":null,"StatusCode":null} 
principalId: 22222222-2222-2222-2222-222222222222 
requestMethod: POST 
requestUrl: https://abc123.com/api/v1/get 
responseData: {"Value":{"Data":{"Items":[{"FieldType":"abc","Value":""},{"FieldType":"123","Value":""},{"FieldType":"xyz","Value":""}],"EncryptedDocKey":"123456789","Domain":"Order","Partner":"india","Carrier":"idea"},"RequestTrackerId":"7894561230","Message":"OK"},"Formatters":[],"ContentTypes":[],"DeclaredType":null,"StatusCode":null} 
time: 2019-07-10 18:35:23.3893, 
traceId: 12345678963525, 
userName: abc/12345 
}

All the fields are indexed correctly. I am looking to extract json data in message element. I would like to extract FieldType,EncryptedDocKey,Domain,Partner,Carrier,RequestTrackerId in to its own fields using spath .

any other alternative options are also welcome. Thanks you for your help.

Tried regex but it did not work

CLAbeel
  • 1,078
  • 14
  • 20
Praveen
  • 11
  • 3
  • 1
    Welcome to Stack Overflow. It's kind of hard to tell what the issue is because what was posted is not valid json when pasted into a validator. Is that exactly what is in the log? – CLAbeel Jul 13 '19 at 12:01
  • @Praveen Can you please share your JSON data in CODE format ? – kamlesh vaghela Jul 16 '19 at 06:51
  • 1
    Have a look at spath within | eval. https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/TextFunctions#spath.28X.2CY.29 – Alec Collier Jul 31 '19 at 02:59
  • You say you "tried regex but it di not work". What regex did you try? You should be able to `| rex field=message ...` whatever you're looking for – warren Jul 22 '22 at 15:26

0 Answers0