Field parsing from Json

rahulg — Tue, 09 Mar 2021 17:59:34 GMT

I have below json format data in Splunk index we know splunk support json it is already extracted fields

like event_simpleName

{"FileDeletedCount":"0","DirectoryCreatedCount":"0","ContextThreadId":"0","aip":"1.2.3.34","NetworkConnectCount":"0","NetworkListenCount":"0","event_platform":"Mac","NetworkBindCount":"0","NetworkRecvAcceptCount":"0","id":"31chdshduf-eb-a92adkh","NewExecutableWrittenCount":"0","NetworkCloseCount":"0","SuspectStackCount":"0","timestamp":"161233596129","event_simpleName":"EndOfProcess","RawProcessId":"72363","ContextTimeStamp":"1615298594.566","ConfigStateHash":"123345","ContextProcessId":"34ddf404471","AsepWrittenCount":"0","SuspiciousDnsRequestCount":"0","S6677HashData":"481572c78b13ebecd3f35d223d86e484fghlsjdljfldjfrce","ConfigBuild":"1007.4.0012205.1","NetworkCapableAsepWriteCount":"0","ExecutableDeletedCount":"0","TargetProcessId":"343242632616804471","DnsRequestCount":"0","Entitlements":"15","name":"EndOfProcessMacV15","aid":"gsdehlsahfhsafkskcdnnf","cid":"3sdkfksfjsjfjlfsj4d14ab9e0063774b51f9"}

i want to create new field for event_simpleName as sysmon and keep original field as well

and create new fields for it's value which EndOfProcess as process_terminated currenlty value doent show in extracted fields

i tried to use props.conf it doent work, deployed on search heads as well HF

FILEDALIAS -sysmon = event_simpleName as symon

any suggestion here ?

topic Field parsing from Json in Getting Data In

Field parsing from Json