topic Re: Apply spath automatically to a sourcetype with nested JSON in Getting Data In

Apply spath automatically to a sourcetype with nested JSON

Motoko89 — Wed, 16 Jan 2019 23:16:50 GMT

Hi all, I have JSON events with complex properties, aka nested JSON objects. I know how to apply spath and create macro. But I want to apply the macro automatically to the sourcetype. Something similar to automatic lookup. How do I do this? Thanks,

EDIT:
I already have INDEXED_EXTRACTIONS. I can search first-level fields just fine. But some of these fields are of type JSON object. Example:

    {
      "field1": "stringValue",
      "field2": [
         {
             "field2_field1": 20
         }
      ]
     }

How do I search field2_field1 value without doing spath?

Re: Apply spath automatically to a sourcetype with nested JSON

harsmarvania57 — Thu, 17 Jan 2019 10:19:29 GMT

Hi,

Question title and descriptions bit misleading, please find below comment based on Question title Apply spath automatically to a sourcetype with nested JSON

If you only want to apply spath to extract all fields from Nested JSON then I'll suggest to ingest data with JSON extractions.

If you are forwarding data from Universal Forwarder then use below configurations on UF.

props.conf

[yoursourcetype]
INDEXED_EXTRACTIONS = JSON

Re: Apply spath automatically to a sourcetype with nested JSON

nikita_p — Thu, 17 Jan 2019 11:03:43 GMT

Hi,
Please find the accepted answers in below link on splunk answers, this might help you:
https://answers.splunk.com/answers/202023/is-it-possible-to-create-a-macro-to-do-this.html

Re: Apply spath automatically to a sourcetype with nested JSON

Motoko89 — Thu, 17 Jan 2019 22:47:07 GMT

No, it is exactly what I want. I already have INDEXED_EXTRACTIONS. I can search first-level fields just fine. But some of these fields are of type JSON object. Example:

    {
      "field1": "stringValue",
      "field2": [
         {
             "field2_field1": 20
         }
      ]
     }

How do I search field2_field1 without doing spath?

Re: Apply spath automatically to a sourcetype with nested JSON

Motoko89 — Thu, 17 Jan 2019 22:52:09 GMT

Hi, I don't think it does. Please see my edit

Re: Apply spath automatically to a sourcetype with nested JSON

harsmarvania57 — Fri, 18 Jan 2019 09:01:04 GMT

I have ingested above sample data in my lab environment with INDEXED_EXTRACTIONS = JSON and it extracted nested JSON as well with field name field2{}.field2_field1

To access this field easily for further usage in stats or any other command it will be good to rename it like | rename field2{}.* as * and after that you will able to see field called field2_field1 in Interesting fields.

Re: Apply spath automatically to a sourcetype with nested JSON

Motoko89 — Fri, 25 Jan 2019 22:30:49 GMT

Thanks! This works for me

Re: Apply spath automatically to a sourcetype with nested JSON

woodcock — Sat, 26 Jan 2019 18:30:36 GMT

The other way is to props.conf on your search head(s) with:

[YourSourcetypeHere]
KV_MODE = json