topic Re: How to use spath command in props.conf or transforms.conf in Splunk? in Getting Data In

How to use spath command in props.conf or transforms.conf in Splunk?

MAMAOUI — Wed, 27 Jun 2018 07:55:14 GMT

Hello ,

I used spath command to extract field from json data:

{"key":"value", "key":"value", "key":"value", "key":"value", "key":"value" ...}

and I got the results that I wanted (.. | spath input = json)

My question is how can I get the same results in props.conf or transforms.conf?

Thank you for answer

M&A

richgalloway — Wed, 27 Jun 2018 13:22:27 GMT

Use INDEXED_EXTRACTIONS = JSON in props.conf.

MAMAOUI — Thu, 28 Jun 2018 08:54:21 GMT

I used KV_MODE=JSON and it works but my probleme is that i have 2 json
format in the same data :

{"key1":"value1", "key2":"value2", "key3": "{\"key30\":values30,\"key31\":values31........ \"}"}

I dont know if there are any way to use spath in props , some thig like
Eval-Key3=spath ....

Thankyou

MuS — Thu, 28 Jun 2018 09:00:36 GMT

Nope, that will not work. But you can use any kind of regex as transforms to get around this JSON in JSON problem. See this answer https://answers.splunk.com/answers/319646/how-to-write-the-regex-to-extract-data-inside-squa.html to learn how it can be done.

Additional hint: the regex mentioned in this answer will not work for your JSON in JSON thing ... try \\"([^\\]+)\\":([^,]+) for a start 😉

cheers, MuS

MAMAOUI — Fri, 29 Jun 2018 12:35:28 GMT

ok I will try .thank you