topic Re: How can I search specific object value of json data in spunk? in Getting Data In

How can I search specific object value of json data in spunk?

chaithanyaSplun — Tue, 29 Sep 2020 16:54:34 GMT

How can I search for results where value of C is 987654321 and E is null from the below sample.

CLASS=Test MTD=getMethod LN=10 : METRICS_JSON_NODE=
"ABC": [
{
"A": "abc",
"B": "c1b1a1",
"C": 987654321,
"D": 123,
"E": 123456789,
"F": false,
"G": "bcfaff1d50025094089f5a02d0dbd00e568d7dbe"
}
]
}

Re: How can I search specific object value of json data in spunk?

niketn — Tue, 21 Nov 2017 09:06:37 GMT

@chaithanyaSplunk, try the following run anywhere search based on sample data provided. You need to put in your base search instead of first two pipes i.e. | makeresults and | eval _raw ..., which are used to generate mock data.

Your JSON Data needs to be extracted from _raw, which I have done using rex command and extracted jsonData. The jsonData is fed to spath command as input to extract all the fields. Finally where command is used to implement the filter you need.

|  makeresults
|  eval _raw="CLASS=Test MTD=getMethod LN=10 : METRICS_JSON_NODE=
\"ABC\": [
{
\"A\": \"abc\",
\"B\": \"c1b1a1\",
\"C\": 987654321,
\"D\": 123,
\"E\": 123456789,
\"F\": false,
\"G\": \"bcfaff1d50025094089f5a02d0dbd00e568d7dbe\"
}
]
}"
|  rex "(?ms)\"ABC\": \[(?<jsonData>[^\]]+\])"
|  spath input=jsonData
|  where C=987654321 AND isnotnull(E)

Re: How can I search specific object value of json data in spunk?

niketn — Tue, 21 Nov 2017 09:13:53 GMT

You can also try search command instead of final where pipe

 <YourBaseSearch>
|  rex "(?ms)\"ABC\": \[(?<jsonData>[^\]]+\])"
|  spath input=jsonData
| search C=987654321 AND E=*

Re: How can I search specific object value of json data in spunk?

niketn — Fri, 24 Nov 2017 04:13:22 GMT

@chaithanyaSplunk, can you please confirm whether this resolved your issue or not?