How to parse all json fields in mixed unstructured+structured event?

zachsisinst — Mon, 06 Jun 2022 17:40:19 GMT

Hi there, I have this type of event coming into splunk:

```
[redacted:54407 24943076666] Processing MessageDispatcher.deliver_batch([#<Message::Queued:0x0000aaab14d8f418 @id=10440927, @created_at=Fri, 03 Jun 2022 14:21:43.890133282 UTC +00:00>, #<Message::Queued:0x0000aaab14dbc8c8 @id=10440928, @created_at=Fri, 03 Jun 2022 14:21:43.896693884 UTC +00:00>]{"tag":"something","strand":null,"singleton":null,"priority":25,"attempts":0,"created_at":"2022-06-03T14:21:43Z","max_attempts":15,"source":"hostname:redacted,pid:29920"}
```

I would like to extract all of the json fields dynamically without individually pulling them out with multiple rex's. I have tried the following, but I am not seeing the json fields being parsed. `myjson` is successfully extracted, but spath does not pull out individual fields from the json:

```
index="myindex" source="mysource"
| rex field=_raw "(?<myjson>\{.+\})"
| spath myjson
```

Re: How to parse all json fields in mixed unstructured+structured event?

VatsalJagani — Mon, 06 Jun 2022 18:17:43 GMT

@zachsisinst - It should be:

| spath input=myjson

Here is my working search query:

| makeresults | eval _raw="[redacted:54407 24943076666] Processing MessageDispatcher.deliver_batch([#<Message::Queued:0x0000aaab14d8f418 @id=10440927, @created_at=Fri, 03 Jun 2022 14:21:43.890133282 UTC +00:00>, #<Message::Queued:0x0000aaab14dbc8c8 @id=10440928, @created_at=Fri, 03 Jun 2022 14:21:43.896693884 UTC +00:00>]{\"tag\":\"something\",\"strand\":null,\"singleton\":null,\"priority\":25,\"attempts\":0,\"created_at\":\"2022-06-03T14:21:43Z\",\"max_attempts\":15,\"source\":\"hostname:redacted,pid:29920\"}" | rex field=_raw "(?<myjson>\{.+\})" | spath input=myjson

I hope this helps!!!

topic Re: How to parse all json fields in mixed unstructured+structured event? in Getting Data In

How to parse all json fields in mixed unstructured+structured event?

Re: How to parse all json fields in mixed unstructured+structured event?