topic Re: How to extract fields without a name from a JSON event? in Getting Data In

How to extract fields without a name from a JSON event?

dannili — Mon, 16 Jul 2018 03:38:53 GMT

Hi all, I'm using virtual index to access log files stored in Hadoop and then trying to extract certain values from JSON formatted file. But the the parsed file does not have name but only string values enclosed in ""with comma between them so the rex wouldn't work. So I was wondering if there's any possible solution to extract these. here's one example:(For example I'm extracting two email address)

11:14:45.000 AM "admin0f.online.lync.com","073e10cd-3910-46d9-95ee-e72ff0ed41dc","False","f24484cef680422ca872a99e47986e5d;add34fecd1;44a0bc0b3e","","7/13/2018 9:34:52 AM","7/13/2018 9:36:44 AM","jessica@example.com","alex@example.com","UCCAPI/16.0.9330.2118 OC/16.0.9330.2118 (Skype for Business)","UCCAPI/16.0.9330.2118 OC/16.0.9330.2118 (Skype for Business)","","","34872F8C-DBB6-53AD-8815-9328990D7FB8","B4DD4A65-1BFA-5E22-9194-F8D06EA27D9F","","","","","200","[IM]","{""RequestType"":""BYE"",""RequestTime"":""2018-07-13T09:36:44.016"",""ContentType"":""application/sdp;call-type=im"",""ResponseCode"":"""",""DiagnosticId"":51004,""ErrorCategory"":""Success"",""DiagnosticHeader"":""51004; reason=\""Action initiated by user\"";\""OriginalPresenceState=\""\""3000\""\"";CurrentPresenceState=\""\""3000\""\"";MeInsideUser=\""\""No\""\"";ConversationInitiatedBy=\""\""6\""\"";SourceNetwork=\""\""2\""\"";RemotePartyCanDoIM=\""\""Yes\""\""\""""} {""RequestType"":""BYE"",""RequestTime"":""2018-07-13T09:36:43.5572341"",""ContentType"":"""",""ResponseCode"":""200"",""DiagnosticId"":51004,""ErrorCategory"":""Success"",""DiagnosticHeader"":""51004; reason=\""Action initiated by user\""""}

Re: How to extract fields without a name from a JSON event?

acharlieh — Mon, 16 Jul 2018 04:59:29 GMT

That event is not JSON ... it's a CSV, where one field happens to be JSON encoded within it. You should look into defining a sourcetype, that defines extractions based on delimiters.

You can use the field extractor to help you with this definition:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/FXSelectMethodstep
http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/FXRenameFieldsstep

Alternatively you could use regular expressions to skip through a certain number of groups of (Not comma, comma) until you come to your email addresses that you want to extract, but that seems more tedious.

Re: How to extract fields without a name from a JSON event?

dannili — Mon, 16 Jul 2018 05:15:02 GMT

Yes you are right.. I totally misinterpreted it. Thanks a lot!

Re: How to extract fields without a name from a JSON event?

dannili — Mon, 16 Jul 2018 05:33:08 GMT

btw there's a typo in question... I meant exactly the regular expression, that is, rex.