topic Can you help us parse the following JSON ? in Getting Data In

Can you help us parse the following JSON ?

saranya12 — Mon, 21 Jan 2019 18:51:37 GMT

i have tried the spath command, but no results. I would like to display the below data into a table as shown below:

10:40:19.682 INFO  com.sample.splunk.service.splunkService - Splunk_SampleJson —>{“fileNamesList:[{“fileName”:”fileName1.zip"},{"fileName":"fileName2.zip”},{“fileName":"fileName3.zip”}]} I wanted to get data in table format

FileName
——————
fileName1
fileName2
FileName3

Re: Can you help us parse the following JSON ?

somesoni2 — Mon, 21 Jan 2019 20:03:54 GMT

Thats probably because spath works on pure json data and your long entry is not pure json (it has those timestamps and other info before the json portion). You can extract the json portion into a new field and use spath on that, e.g.

your base search | rex "^([^\{]+)(?<jsondata>.+)$" | spath input=jsondata

Re: Can you help us parse the following JSON ?

saranya12 — Mon, 21 Jan 2019 20:30:12 GMT

Thank you worked for me , adding complete search query it might help some one

my base search | rex "^([^\{]+)(?<jsondata>.+)$" |spath input=jsondata output=fileName path=fileNamesList{}.fileName |table fileName

Re: Can you help us parse the following JSON ?

somesoni2 — Mon, 21 Jan 2019 21:55:25 GMT

Thanks for sharing your working search. Please remember to format your searches/code snippet by selecting the query and clicking on "101010" button on the top of the text area.

Please mark this question answered by accepting this as an answer.

Re: Can you help us parse the following JSON ?

woodcock — Mon, 21 Jan 2019 22:15:16 GMT

Like this:

| makeresults 
|  eval _raw="10:40:19.682 INFO com.sample.splunk.service.splunkService - Splunk_SampleJson —>{\"fileNamesList:[{\"fileName\":\"fileName1.zip\"},{\"fileName\":\"fileName2.zip\"},{\"fileName\":\"fileName3.zip\"}]}"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex max_match=0 "\"fileName\":\"(?<fileName>[^\"]+)"
| table fileName
| mvexpand fileName

You may not need the last line (try with and without).