topic Re: Extracting fields from JSON - Whois Add On in Getting Data In

Extracting fields from JSON - Whois Add On

zowa — Sun, 08 Jun 2014 21:56:16 GMT

Hello,

I am using the Whois Add On to get Whois information from ip addresses. Here is an example:

It creates a new field called whois, with the information from the online whois database:

['{"DomainName":"8.8.8.8","RegistryData":{"AbuseContact":{"Email":"arin-contact@google.com","Name":"Google Inc","Phone":"+1-650-253-0000"},"AdministrativeContact":{"Email":"arin-contact@google.com","Name":"Google Inc","Phone":"+1-650-253-0000"},"BillingContact":null,"CreatedDate":"2014-03-14T16:52:05-04:00","RawText":null,"Registrant":{"Address":"1600 Amphitheatre Parkway","City":"Mountain View","Country":"US","Name":"Google Inc.","PostalCode":"94043","StateProv":"CA"},"TechnicalContact":{"Email":"arin-contact@google.com","Name":"Google Inc","Phone":"+1-650-253-0000"},"UpdatedDate":"2014-03-14T16:52:05-04:00","ZoneContact":null}}']

I am trying to use spath to extract the fields from the JSON results, but no success yet... I´ve read somewhere that Splunk 6 extract the JSON fields automatically... Well... Any idea how to extract the fields, in order to present the results in a more organized way? That would help a lot! 🙂

Thanks!

Re: Extracting fields from JSON - Whois Add On

gkanapathy — Mon, 09 Jun 2014 05:53:41 GMT

The string is not pure JSON, and spath needs a pure JSON string. You have to strip the square brackets ([]) and single quotes (') around the JSON. e.g.,

... | eval whois = substr(whois,2) | eval whois = substr(whois,-2) | ...

or something a little more precise.

Re: Extracting fields from JSON - Whois Add On

zowa — Tue, 17 Jun 2014 17:56:58 GMT

Thanks, you put me in the right path!

The final search was: