topic How to parse/index only json entry from raw data which are in non-uniform pattern? in Getting Data In

How to parse/index only json entry from raw data which are in non-uniform pattern?

Boopalan — Mon, 27 Jan 2020 07:10:11 GMT

How to parse/index only json entry from raw data which are in non-uniform pattern?

Re: How to parse/index only json entry from raw data which are in non-uniform pattern?

Boopalan — Mon, 27 Jan 2020 07:17:13 GMT

From the below raw data only json need to be extracted/indexed in the splunk and should be viewed as json structured view while searching this logs on search head

<BOR>
ExSrc:Schwab.Client.Fx^
URL:null^
LogMsg:{"actor":{"Cust":null,"Acct":null,"Rep":null,"System":null},"header":{"AppId":null,"RecId":"null","Ver":"","StartTS":"null"},"source":{"Ip":"*","MacAddress":null,"SRCOS":"null","SRCRuntime":null,"SRCAppName":null,"SRCAppVersion":null,"SRCReqId":"null","CorrelationId":"null","SourceId":null,"Uri":"null"}}^
ExType:Common.Exceptions.ServiceCommunicationException^
<EOR>

Re: How to parse/index only json entry from raw data which are in non-uniform pattern?

to4kawa — Mon, 27 Jan 2020 07:47:18 GMT

| makeresults 
| eval _raw=" <BOR>
  ExSrc:Schwab.Client.Fx^
  URL:null^
  LogMsg:{\"actor\":{\"Cust\":null,\"Acct\":null,\"Rep\":null,\"System\":null},\"header\":{\"AppId\":null,\"RecId\":\"null\",\"Ver\":\"\",\"StartTS\":\"null\"},\"source\":{\"Ip\":\"*\",\"MacAddress\":null,\"SRCOS\":\"null\",\"SRCRuntime\":null,\"SRCAppName\":null,\"SRCAppVersion\":null,\"SRCReqId\":\"null\",\"CorrelationId\":\"null\",\"SourceId\":null,\"Uri\":\"null\"}}^
  ExType:Common.Exceptions.ServiceCommunicationException^
  <EOR>" 
| rex "(?<json>(?={).+})" 
| spath input=json 
| table actor* header* source*

Extracting in search, like this.

Re: How to parse/index only json entry from raw data which are in non-uniform pattern?

Boopalan — Mon, 27 Jan 2020 07:56:23 GMT

Is there anyway to make this possible through configuration changes while parsing/indexing the log file itself

Re: How to parse/index only json entry from raw data which are in non-uniform pattern?

to4kawa — Mon, 27 Jan 2020 10:20:30 GMT

sorry, I can't. please ask others.
please tell me why do you want while parsing/indexing the log file itself?
Is collect bad?