topic Re: Can you help me get multiple fields from a single field in JSON? in Getting Data In

Can you help me get multiple fields from a single field in JSON?

danw25 — Sun, 09 Dec 2018 06:36:39 GMT

The text field in my event contains A LOT of data.

json snipped :

{"Date":"2018-12-05T12:04:04.71","ID":"00000000-0000-0000-0000-000000000000","Text":"*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***}

What i'm trying to do is write a search that will get all values of on/all fields.

i.e. "get all values of userCount"

i have had some progress using eval and split

eval values=split(Text," * ") |
eval temp=mvindex(values,0)|
eval temp=split(temp,"=")|eval temp=mvindex(temp,1)|convert rmunit(temp)|    
eval normalSliceUsage=temp| table Date normalSliceUsage

Re: Can you help me get multiple fields from a single field in JSON?

whrg — Sun, 09 Dec 2018 16:09:30 GMT

Does one event in Splunk contain multiple lines of text or only one line?
When you search for your events in Splunk, is the field "userCount" available on the left side?

Re: Can you help me get multiple fields from a single field in JSON?

prakash007 — Sun, 09 Dec 2018 17:20:26 GMT

I guess Splunk should auto-extract field values when they are in foo=bar format, check your interesting fields for userCount, if not pls post a snippet of your json data.

Re: Can you help me get multiple fields from a single field in JSON?

sdchakraborty — Mon, 10 Dec 2018 08:58:52 GMT

Hi,

Can you try the below search, the idea is to create those fields using rex.

index=<your index>
|  rex field=Text normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)

you can checkout the how the rex working in the below site,

https://regex101.com/

in the test string give the below,

*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***

in the regex give the below regex,

 normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)