Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to extract JSON from my sample event data?

$
0
0
Hello, We are trying to extract the substring (JSON) object from the one of the properties of the log: { [-] Message: EventName="MessageEvent" Message="***{"Timestamp":"2016-07-12T23:52:37.8061339+00:00","Level":"Information","MessageTemplate":"Test event processor open. partitionId: {partitionId}, offset: {offset}","Properties":{"EventId":1042,"activityId":"4537fec0-e72f-49cf-97df-754bbcc525b4","loggerMethod":"_open","offset":"5664","partitionId":"1","SourceContext":"TestEventReceiver.TestEventProcessor"}}***" TraceSource="WaWorkerHost.exe" Timestamp: 2016-07-12 23:54:12.543427+00:00 etag: W/"datetime'2016-07-12T23%3A54%3A12.5434277Z'" } The purpose of extraction is to be able to index the json properties rather than the string. The RegEx that I came up for extracting the substring is: `Message="(?.*?)" TraceSource=`, but not sure how to approach it. Can you please suggest an approach?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>