topic Re: Extract fields from json and nested json in Getting Data In

Extract fields from json and nested json

gemrose — Wed, 03 Apr 2024 10:57:11 GMT

I am using regex to extract the field from the below json data. I want to extract the fields in key-value pair specially log.message from the json data. Example if I need "action" field from log.message

clusterName: cluster-9gokdwng4f internal_tag: internal_security log: { [-] message: {"action":"EXECUTE","class":"System-Queue","eventC":"Data access event","eventT":"Obj-Open with role","timeStamp":"Wed 2024 Apr 03, 04:58:28:932"} stack: thread_name: Batch-1 timestamp: 2024-04-03T04:58:28.932Z version: 1 } }

Re: Extract fields from json and nested json

PickleRick — Wed, 03 Apr 2024 08:28:41 GMT

1. Don't use simple regexes to manipulate structured data. Earlier or later you'll regret it (you'll get yourself in a situation with some (un)escaped delimiter or similar thing).

2. This is not a well-formed json.

3. Splunk doesn't handle well json (or any other structured data like XML) with additional content "surrounding" it in terms of automatic extraction so your best bet would be to extract the json part (with caution - see point 1) and run spath command on that field. Unfortunately it cannot be made as automatic extraction. It needs to be invoked manually in your search pipeline.

Re: Extract fields from json and nested json

gemrose — Tue, 16 Apr 2024 10:04:47 GMT

I used spath for extraction