How to extract JSON format using rex command, removing double quotes & semi colon?
"TranID":"a2775f5d", "TranStartTime":"2017-08-14T05:19:22.939-04:00", "TranEndTime":"2017-08-14T05:19:22.961-04:00"
When I extract
rex field=_raw "TranStartTime\S\S\S(?[^ ]+)"
2017-08-14T07:15:53.919-04:00",
Actually I need:
2017-08-14T07:15:53.919-04:00
Try like this
... | rex field=_raw "TranStartTime\"\:\"(?<TransStartTime>[^\"]+)"
@somesoni2, this worked perfectly fine, but trying to rex
from the json field didn't work for us. Something like - | rex field=TranStartTime "<regular expression>"
Anything we miss here?
You're running your rex on field TranStartTime , is it already extracted/available???
right, it's available as a field.