topic Re: JSON Data issues in Getting Data In

JSON Data issues

chiraggl — Wed, 30 Sep 2020 03:28:36 GMT

observations_statistics: { [-]
risk_vectors: { [-]
botnet_infections: { [-]
average_duration_days: 14.2
count: 45
count_period: year
}
malware_servers: { [-]
average_duration_days: 0
count: 0
count_period: year
}
potentially_exploited: { [+]
}
spam_propagation: { [+]
}
unsolicited_comm: { [+]
}

How can I inherit inner properties and values to get count and count period properties to display a line graph?

Re: JSON Data issues

kamlesh_vaghela — Mon, 23 Dec 2019 16:33:09 GMT

@chiraggl

If you have valid JSON event then Splunk will extract fields for you. So you can easily get values. Try below search.

YOUR_SEARCH | table "observations_statistics.risk_vectors.botnet_infections.count" "observations_statistics.risk_vectors.botnet_infections.count_period" "observations_statistics.risk_vectors.malware_servers.count" "observations_statistics.risk_vectors.malware_servers.count_period"

Sample

| makeresults | eval _raw="{\"observations_statistics\": {\"risk_vectors\": {\"botnet_infections\": {\"average_duration_days\": \"14.2\",\"count\": \"45\",\"count_period\": \"year\"},\"malware_servers\": {\"average_duration_days\": \"0\",\"count\": \"0\",\"count_period\": \"year\"}}}}"| extract | table "observations_statistics.risk_vectors.botnet_infections.count" "observations_statistics.risk_vectors.botnet_infections.count_period" "observations_statistics.risk_vectors.malware_servers.count" "observations_statistics.risk_vectors.malware_servers.count_period"

After this If you share some valid JSON event and expect output then it will be very helpful for us.

Re: JSON Data issues

Richfez — Thu, 26 Dec 2019 15:20:21 GMT

@chiraggl
Did that comment by @kamlesh_vaghela help you? Do you need more assistance?

If you have it solved, great! Let us know, or even write up your own answer and mark this question as answered. And upvote any other things you found handy for that.

If not, then let us know what else you need and maybe we can help!

-Rich