Search code examples
splunksplunk-query

How to extract fields from JSON string in Splunk

In Splunk after searching I am getting below result-

FINISH OnDemandModel - Model: Application:GVAP RequestID:test_manifest_0003 Project:AMPS EMRid:j-XHFRN0A4M3QQ status:success

I want to extract fields like Application, RequestID, Project, EMRid and status as columns and corresponding values as those columns' values.

I am new to Splunk and not sure how to use spath or other search commands.

Solution

  • Use the rex command:

    <search>
rex field=yourfield "Application:(?<application>\w+)\sRequestID:(?<requestid>\w+)\sProject:(?<project>\w+)\sEMRid:(?<emrid>\w+)\sstatus:(?<status>\w+)"

    Fine-tune your regexes over at regex101.com