Splunk Search

How do I extract fields from a json object (serialized) and put it back to splunk index?

arungeorge09
Path Finder

Sample data:

<167>1 2014-11-15T16:45:44.542-07:00 host.name.com neat 11151 gcm [meta@28281 sequenceId="43096" sysUpTime="858744854"][analytics@28281 event="pushGcm" platform="GCM" outcome="0" errorCode="0" errorDesc="Push to apns success" errorContext="TCP-SSL" operation="PUSH_GCM" opTime="46" startTime="1416095144542" appId="appId" deviceToken="token" args="{\"time\":\"1416095144194\",\"batch\":\"26966\",\"tms_id\":\"tmsid\",\"src\":\"src\"}" txId="907472412"] 

I want to extract the args and put it back in its appropriate fields . I know I can use Field Extractions and Field transformations but not working.

Field Transformation
Name:NEAT_BATCH

Rex: batch\\\\\":\\\\\"(?.*?)\\\\\",

Field Extraction
Name:NEAT_BATCH

0 Karma
1 Solution

tom_frotscher
Builder

Hi,
try it with this regular expression for the batch field:

\\\"batch\\":\\"(?<batch>\d+)\\"

Greetings

Tom

View solution in original post

tom_frotscher
Builder

Hi,
try it with this regular expression for the batch field:

\\\"batch\\":\\"(?<batch>\d+)\\"

Greetings

Tom

arungeorge09
Path Finder

Worked. Thanks Tom. Why does not it work with my regexp . Can you explain

0 Karma

tom_frotscher
Builder

Your regex didn't match. there are way to much "\" symbols in your regex and i think also your group definition "(?.*?)" is syntactically wrong.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...