topic Parsing JSON keys containing dots with SPATH in Getting Data In

Parsing JSON keys containing dots with SPATH

gcsolaroli — Fri, 31 Aug 2012 13:24:59 GMT

I have a JSON log where the key of an element contains dots. A brief example:
{
"a.b.c": {
"d": 10
}
}

Using SPATH function with "a.b.c.d" for the path attribute does not work; but I don't know how to express what in Javascript would be ["a.b.c"].d

Any idea on how to handle this case?

Re: Parsing JSON keys containing dots with SPATH

dart — Tue, 04 Sep 2012 15:33:40 GMT

Is the whole log JSON?
If so, can you set the KV_MODE to json and see if that gives you the fields you need?

## props.conf
[my_json_data_sourcetype]
KV_MODE = json

Re: Parsing JSON keys containing dots with SPATH

gcsolaroli — Tue, 04 Sep 2012 17:16:35 GMT

Log content is already recognized as JSON, and Splunk visualizes matching events as expandable objects (instead of plain grid, as it does when showing regular log entries).

But the problem is that if I try to use a key containing dots in its name (e.g. "a.b.c") than Splunk is not able to match it against anything, as it consider it as key "a", containing key "b", containing key "c": { "a": { "b": { "c": "value" } }}

But my log looks like this: { "a.b.c": "value" }

Re: Parsing JSON keys containing dots with SPATH

dart — Tue, 04 Sep 2012 19:40:09 GMT

What fields do you get in the field picker?

Re: Parsing JSON keys containing dots with SPATH

tfong_splunk — Thu, 20 Sep 2012 17:32:03 GMT

What happens if not all the data is JSON? Can I specify by sourcetype?

Re: Parsing JSON keys containing dots with SPATH

peberhardt — Thu, 03 Jul 2014 18:29:42 GMT

I would love to know how to do this!

Re: Parsing JSON keys containing dots with SPATH

theeansible — Thu, 03 Aug 2017 17:51:35 GMT

Same here.