topic Extracting values from a json log file in Getting Data In

Extracting values from a json log file

Splunkster45 — Tue, 31 Jul 2018 15:40:41 GMT

I have log file that looks like the following:

what's the best way to extract each value here. I want to evetually download this as a csv file. I'm okay with the dictionary/json for message still being a dictionary/json.

{"source_host":"a.com","method":"new","level":"INFO","message":"value = {\"sessionId\" :\"1\",\"number\":\"2\"}"}

I tried using | spath output=_raw path=source_host, but and that worked, but I can't get multiple fields e.g.

| spath output=_raw path=source_host|method 
| spath output=_raw path=source_host,method
| spath output=_raw path=*

Any thoughts?

Re: Extracting values from a json log file

sudosplunk — Tue, 31 Jul 2018 16:08:27 GMT

Give this a try |spath output=_raw | table *

If you want to extract multiple values, have a look here.

Re: Extracting values from a json log file

somesoni2 — Tue, 31 Jul 2018 17:45:32 GMT

Just use the spath command (no other parameter) to extract all fields, as long as your raw data is in pure json format. See this runanywhere sample based off your sample data (additional backslashes are added to inline data generation)

| gentimes start=-1 | eval _raw="{\"source_host\":\"a.com\",\"method\":\"new\",\"level\":\"INFO\",\"message\":\"value = {\\\"sessionId\\\" :\\\"1\\\",\\\"number\\\":\\\"2\\\"}\"}" | table _raw 
| spath