How to extract json value fields?

karthi2809 — Fri, 12 Jan 2024 08:11:33 GMT

"reqUser":"mhundi","evtTime":"2023-06-08 14:04:06.504","access":"SELECT","resource":"dsc60180_ici_sde_tz_db/vehicle_master/light_truck_lob_flag,lincoln_lob_flag,model_e_lob_flag,vehicle_make_desc,vehicle_type_desc,warranty_start_date,vehicle_type_desc,warranty_start_date","resType":"@column","action":"select","result":1,"agent":"hiveServer2","policy":101343,"enforcer":"ranger-acl","sess":"00ef27f9-75a4-4821-9e8a-60f16af6b962","cliType":"HIVESERVER2","cliIP":"19.51.78.185","reqData":"SELECT * FROM (SELECT `Left`.`advisor_name`, `Left`.`appointment_created_by`, `Left`.`appointment_datetime

Fields to be extract

reqUser, evtTime, resource

Re: How to extract json value fields?

isoutamo — Fri, 12 Jan 2024 09:31:27 GMT

this is not a json data. It could be part of if but not really full, working json.

If you have full json, it should be usable without any difficulties e.g. with spath if/when onboarding has done correctly.

If it's not working json then you must use e.g. rex command to get wanted values from _raw event.

| rex "\"reqUser\":\"(?<reqUser>[^\"]+)\",\"evtTime\":\"(?<evtTime>[^\"]+)\"," | rex "\"resource\":\"(?<resource>[^\"]+)\"" | table reqUser evtTime resource

r. Ismo

topic How to extract json value fields? in Splunk Dev

How to extract json value fields?

Re: How to extract json value fields?