topic Re: How do I rename unknown field name in a JSON file? in Getting Data In

How do I rename unknown field name in a JSON file?

sebastianstruwe — Wed, 24 Oct 2018 13:47:09 GMT

Hi Splunker,

I want to rename an unknown field name from a JSON file. Please find the minimal example below:

{"timestamp": "2018-10-24T08:46:02.205664", 
"type": "sw", 
"serial": {"Switchah3nv": "000123456789"}, 
"system_time": "Wed Oct 24 08:46:04 CEST 2018", 
.....
}

{"timestamp": "2018-10-24T08:47:02.205664", 
"type": "fw", 
"serial": {"Switchcklaie7": "000987654321"}, 
"system_time": "Wed Oct 24 08:47:04 CEST 2018", 
.....
}

I'm trying to make a table for all the serial numbers. So something like:

hostname      | serial_number
Switchah3nv  |000123456789
Switchcklaie7 |000987654321

I'm able to rename one serial by using | rename serial.Switchah3nv AS serial_number , but I need something like | rename serial.{} AS serial_number or | rename serial.hostname AS serial_number

So anyone got an idea?

Best regards,

Sebastian

Re: How do I rename unknown field name in a JSON file?

cpetterborg — Wed, 24 Oct 2018 14:13:07 GMT

Something like the following should work for you (this is a run-anywhere search that you can copy/paste into your Splunk search bar and it will run):

| makeresults
| eval data="{\"timestamp\": \"2018-10-24T08:46:02.205664\", 
 \"type\": \"sw\", 
 \"serial\": {\"Switchah3nv\": \"000123456789\"}, 
 \"system_time\": \"Wed Oct 24 08:46:04 CEST 2018\",}"
| rex field=data "\"serial\": \{\"(?<hostname>[^\"]*)\": \"(?<serial_number>[^\"]*)\""
| table hostname, serial_number

The rex line is probably the only line (with the exception of the table line) that you really need to worry about, but it shows what you can do with the search to get the data that you want. The field=data part of the rex line will probably have to be changed to match your data.

Re: How do I rename unknown field name in a JSON file?

mstjohn_splunk — Wed, 24 Oct 2018 22:16:37 GMT

Hi @sebastianstruwe

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!