topic Re: How do I strip the namespace of JSON fields? in Getting Data In

How do I strip the namespace of JSON fields?

ddrillic — Tue, 18 Sep 2018 15:03:24 GMT

Based on How to assign a field alias to a json field?

We ended up with large blocks as -

FIELDALIAS-alias0 = "apiRequest.reqInfo.clientID" AS clientID
FIELDALIAS-alias1 = "apiRequest.reqHeader.appContext" AS appContext
FIELDALIAS-alias2 = "apiRequest.reqHeader.dob" AS dob
FIELDALIAS-alias3 = "apiRequest.reqHeader.encryptedUserName" AS encryptedUserName
FIELDALIAS-alias4 = "apiRequest.reqHeader.firstName" AS firstName
FIELDALIAS-alias5 = "apiRequest.reqHeader.lastName" AS lastName
FIELDALIAS-alias6 = "apiRequest.reqHeader.memberId" AS memberId
....

Is there a way to strip the JSON namespace of the fields instead of aliasing each one of them as we do above?

Re: How do I strip the namespace of JSON fields?

kamlesh_vaghela — Tue, 18 Sep 2018 15:13:50 GMT

@ddrillic

Can you please share some sample data?

Re: How do I strip the namespace of JSON fields?

somesoni2 — Tue, 18 Sep 2018 15:40:13 GMT

Have a look at this
https://answers.splunk.com/answers/588790/field-alias-or-batch-renaming-with-wildcard.html

Re: How do I strip the namespace of JSON fields?

ddrillic — Tue, 18 Sep 2018 15:45:27 GMT

Much appreciated @somesoni2 !!!

Re: How do I strip the namespace of JSON fields?

ddrillic — Tue, 18 Sep 2018 15:46:25 GMT

Our sales engineer said -

Unfortunately, the FIELDALIAS stanza in props.conf cannot accept wildcards. You’d have to write a custom field extraction (though this is pretty trivial) and give-up the automatic field extractions Splunk performs on the JSON structure.