payload : {"nodeId":34567,"cycleCode":10}
someone please help me in how to extract nodeID
i tried like this :
rex field=_raw "\"nodeId\"\s:\s(?P)"
Hi
Try this
| makeresults
| eval temp="payload : {\"nodeId\":34567,\"cycleCode\":10}"
| rex field=temp "payload\s:\s\{\"nodeId\"\:(?P<nodeId>[^,]+)"
or
| makeresults
| eval temp="payload : {\"nodeId\":34567,\"cycleCode\":10}"
| rex field=temp "payload\s:\s\{\"nodeId\"\:(?P<nodeId>\d+)"