topic Re: Extract value from json in props.conf in Getting Data In

Extract value from json in props.conf

Poojitha — Mon, 17 Jun 2024 12:30:30 GMT

Hi All,

I want to extract email from json event in splunk.

Query I am using is :

index=*sec sourcetype=test | eval tags_json=spath(_raw, "Tag{}"), final_tag_json=json_object() | foreach mode=multivalue tags_json [ | eval final_tag_json=json_set(final_tag_json, spath('<<ITEM>>', "Key"), spath('<<ITEM>>', "Value"))] | spath input=final_tag_json | rex field=Email "(?<email>^\w+@abc.com$)"

Raw data :

"Tag": [{"Key": "app", "Value": “test”_value}, {"Key": "key1", "Value": "value1"}, {"Key": "key2", "Value": "value2"}, {"Key": “email”, "Value": “test@abc.com}],

I want email to be mapped to contact when indexed. How can I achieve this ? Please help me

Regards,
pnv

Re: Extract value from json in props.conf

KendallW — Tue, 25 Jun 2024 06:07:13 GMT

Hi @Poojitha following the example from the documentation on spath: https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Spath#3:_Extract_and_expand_JSON_events_with_multi-valued_fields

Here is a runanywhere example:

| makeresults | eval _raw="{ \"Tag\": [ {\"Key\": \"app\", \"Value\": \"test_value\"}, {\"Key\": \"key1\", \"Value\": \"value1\"}, {\"Key\": \"key2\", \"Value\": \"value2\"}, {\"Key\": \"email\", \"Value\": \"test@abc.com\"}, ] } " | spath | rename Tag{}.Key as key, Tag{}.Value as value | eval x=mvzip(key,value) | mvexpand x | eval x=split(x,",") | eval key=mvindex(x,0) | eval value=mvindex(x,1) | table _time key value