topic Re: Not able to parse json with spath ,something wrong but not json in Getting Data In

Not able to parse json with spath ,something wrong but not json

ekmek4 — Tue, 25 Feb 2025 17:37:11 GMT

Hi,

I need to ingest some logs into splunk, so file&dirs data input its my choice.

Also new index was created , _json as sourcetype. Now im trying to use spath in search to parse JSON data with multifields and no luck yet. Just checked my json file - valid json.

Here we have some parsed json, but i want to get email, first_name,last_name from properties.attributes to be able parse or filter by any of this fields in future

Appreciate any help.

Small source file:

https://paste2.org/OsEXkgbJ

Here is what i tried :

index=ep_log event=created | spath properties.attributes

index=erp_log event=created | spath properties and so on

Re: Not able to parse json with spath ,something wrong but not json

ITWhisperer — Tue, 25 Feb 2025 17:41:26 GMT

Try something like this

| spath properties | spath input=properties attributes

Re: Not able to parse json with spath ,something wrong but not json

ekmek4 — Tue, 25 Feb 2025 18:33:37 GMT

Now i have a new field "attributes"

attributes:

{"email": "gacilia@gmail.com", "clients": {"ERP Frontend": "GEgzvJrIJxxHNS9FVdSvUej5wyrBgd2sSHH7RLuE", "Frontend CRM": "ILrkYrSCSsKgdgxBRv0COxKLaOzKufXogzWEAoh8"}, "is_active": false, "last_name": "Gac", "legacy_id": "66f510fea8f5e1ff130f5fa0", "first_name": "Ilia", "start_date": null, "is_team_supervisor": true, "two_factor_auth_enabled": false}

Re: Not able to parse json with spath ,something wrong but not json

ekmek4 — Tue, 25 Feb 2025 20:44:39 GMT

index=ep_log event=created | spath path=properties | mvexpand properties | spath input=properties

This query automatically expand fields with every attribute key.

Re: Not able to parse json with spath ,something wrong but not json

ITWhisperer — Tue, 25 Feb 2025 22:53:36 GMT

Does this give you what you want?

| spath properties | spath input=properties attributes | spath input=attributes

Re: Not able to parse json with spath ,something wrong but not json

ekmek4 — Wed, 26 Feb 2025 11:08:04 GMT

| spath path=properties | mvexpand properties | spath input=properties

this works fine for me. Thank you!!