How to extract Fields custom JSON File in Splunk

ashish9433 — Sat, 13 May 2017 17:38:35 GMT

I have custom JSON File on Splunk but SPATH command is not able to extract the fields from the data. Can any one suggest me what would be the best way to extract fields from the below JSON Data

{"log":"| loglevel=\"INFO\" | hostname=\"import-1-4-3-2053088235-873gq\" | transactionId=\"a0991eed-46bd-49df-9545-87deae988b6c\" | serviceName=\"import\" | version=\"1.4.3\" | thread=\"https-jsse-nio-8443-exec-12\" | logger=\"c.a.e.s.l.d.s.impl.ScheduleServiceImpl \" | message=\"Get Schedule BOC\" | status=\"GET_SCHEDULE_BOC\" | code=\"00139\" | uri=\"https://layer-1-0-2.schedule-schedule/scheduleLayer/search?version=1\u0026envContext=PROD\u0026routeOffer=BLUE\" | request=\"{\"details.type\":\"signalpath\",\"details.boc\":\"0306\"}\" \n","stream":"stdout","time":"2017-05-13T16:50:41.377682354Z"}

In Splunk the data appears formatted in JSON, but not all the fields appear as JSON formatted and thus i feel SPATH command is not working. I am able to extract the above content in a field named as Log, but the internal fields which are separated by "|". The below is the screenshot how the data appears in Splunk. Can anyone help me in extracting the fields automatically?

Re: How to extract Fields custom JSON File in Splunk

koshyk — Sun, 14 May 2017 06:50:26 GMT

So on your already extracted spath (the screenshot output)

.. | rex field=log "(\w+)=([^\s]+)"

This will split the rest of fields present within log to key-value pairs
Example in regex101: https://regex101.com/r/4Y0aJG/1

topic How to extract Fields custom JSON File in Splunk in Getting Data In

How to extract Fields custom JSON File in Splunk

Re: How to extract Fields custom JSON File in Splunk