Splunk query to extract fields from log data

Question

My Splunk log some thing like [user name] [traceid] ldap authentication { “status” : “success” , “username”: “123”} MULTIEXCEPTION some text….

I am trying out for Splunk query that gives result in tabular format.. any query suggestions?

Status  username 
Success 123
Fail     234

Answer 1

As @PM77-1 wrote, use the rex command to extract fields from events. Then use the (surprise!) table command to put the results in tabular format.

index=foo
``` Extract the status field ```
``` Triple escapes are needed because of multiple layers of processing ```
| rex "status\\\"\s*:\s*\\\"(?<status>[^\\\"]+)"
``` Extract the username field using a separate command for order-independence ```
| rex "username\\\"\s*:\s*\\\"(?<username>[^\\\"]+)"
| table status username