topic Re: Field Extraction from Nested Json during Index time in Getting Data In

Field Extraction from Nested Json during Index time

Poojitha — Tue, 18 Jun 2024 06:23:47 GMT

Hi All,

TagData [ [-] { [-] Key: Application Value: Test_App } { [-] Key: Email Value: test@abc.com } ]

I have nested json data as above.

I want to extract Email field value and map it to new field - owner_email . This need to be done during indexing time.

With normal splunk search , I am getting way :

index=*_test sourcetype="test:sourcetype" source="*:test" | array2object path="TagData" key="Key" value="Value" | rename "TagData.Email" as owner_email

Please help me how to achieve this during indexing time. How do I update props.conf file ?

Regards,
PNV

Re: Field Extraction from Nested Json during Index time

gcusello — Tue, 18 Jun 2024 06:28:19 GMT

Hi @Poojitha ,

the first question is why?

create fields at index time gives additional load to the indexers during indexing, this is possibe if you haven't a big volume of data.

anyway you have to use the way to create fields at index time descripted at https://docs.splunk.com/Documentation/Splunk/9.2.1/Data/Configureindex-timefieldextraction

an ingestions eval then you have to use an ingest eval action descripted at https://docs.splunk.com/Documentation/Splunk/9.2.1/Data/IngestEval

in props.conf

[your_sourcetype] TRANSFORMS-eval1 =eval1

in transforms:

[eval1] INGEST_EVAL = field3=json_extract(email,Tagdata{}.Email)

(please check the path of your json field

in fields.conf

[username] INDEXED=true

Ciao.

Giuseppe

Re: Field Extraction from Nested Json during Index time

Poojitha — Tue, 18 Jun 2024 07:18:51 GMT

@gcusello : Thanks for your response.

Story in short, I want to map certificate details from one of the sources to fields in certificate datamodel. https://docs.splunk.com/Documentation/CIM/5.3.2/User/Certificates.
This is my requirment.

I have mapped two fields using FIELDALIAS - ssl_issuer and ssl_end_time.

Now I want to map TagData.Email to ssl_issuer_email. I am using these fields further.

Regards,
PNV

Re: Field Extraction from Nested Json during Index time

gcusello — Tue, 18 Jun 2024 08:34:07 GMT

Hi @Poojitha,

to do this you don't need to define fields at index time, but also at search time you can load your data in Data Models.

Ciao.

Giuseppe