topic Re: Extracting JSON/XML from string entry and dispalying in table in Dashboards & Visualizations

Extracting JSON/XML from string entry and dispalying in table

amith7 — Tue, 29 Sep 2020 23:27:56 GMT

I am trying to extract various fields from below entry in splunk.
I executed the below splunk query :
index=test_index source="testlogs.log" "InteractionId=test_interaction_id1" | search("||url") | table service,operation,status,status_code,exception,duration,url,request, response
The below is splunk log entry:
2019-02-28 22:21:34.248 [UUID=d791aecb-c320-453a-9207-bf96e01beaaf|InteractionId=test_interaction_id1] INFO com.test.MyLogger - service="TestService"||operation="testOperation"||url="http://localhost:8080/testservice/v4/testOperation"||request="{\"customer\":{\"id\":\"80\",\"name\":\"John\"}}"||request_headers="{Content-Type=application/json,cache-control=no-cache,Accept=application/json}"||response="{\"customerType\":\FIXED\"}"||response_headers="{Set-Cookie=;secure;HttpOnly}"||status="SUCCESS"||status_code="200"||duration="95ms".
request and response fields which are XML or JSON are not displayed properly in the table.
JSON is dispalyed as {\

I would like to have the complete JSON and XML in the table.

Thanks in Advance!

Re: Extracting JSON/XML from string entry and dispalying in table

richgalloway — Fri, 01 Mar 2019 15:29:43 GMT

What do you mean by "request and response fields which are XML or JSON are not displayed properly in the table"? They will not be pretty-printed, if that's what you mean.

Re: Extracting JSON/XML from string entry and dispalying in table

nickhills — Fri, 01 Mar 2019 15:48:54 GMT

Can you repost using the code tool 101010 ?
It looks like some of your content has been stripped from the question (probably because it looked like XML/HTML)

Re: Extracting JSON/XML from string entry and dispalying in table

amith7 — Tue, 29 Sep 2020 23:28:17 GMT

I am trying to extract various fields from below entry in splunk.

I executed the below splunk query :
index=test_index source="testlogs.log" "InteractionId=test_interaction_id1" | search("||url") | table service,operation,status,status_code,exception,duration,url,request, response

The below is splunk log entry:
2019-02-28 22:21:34.248 [UUID=d791aecb-c320-453a-9207-bf96e01beaaf|InteractionId=test_interaction_id1] INFO com.test.MyLogger - service="TestService"||operation="testOperation"||url="http://localhost:8080/testservice/v4/testOperation"||request="{\"customer\":{\"id\":\"80\",\"name\":\"John\"}}"||request_headers="{Content-Type=application/json,cache-control=no-cache,Accept=application/json}"||response="{\"customerType\":\FIXED\"}"||response_headers="{Set-Cookie=;secure;HttpOnly}"||status="SUCCESS"||status_code="200"||duration="95ms"

request and response fields which are XML or JSON are not displayed properly in the table.
JSON is dispalyed as {\

I would like to have the complete JSON and XML in the table.

Re: Extracting JSON/XML from string entry and dispalying in table

amith7 — Tue, 29 Sep 2020 23:28:20 GMT

I am trying to extract various fields from below entry in splunk.

request and response fields which are XML or JSON are not displayed properly in the table.
JSON is dispalyed as {\

I would like to have the complete JSON and XML in the table.

Re: Extracting JSON/XML from string entry and dispalying in table

efavreau — Fri, 01 Mar 2019 22:22:10 GMT

@amith7 What does the raw event look like? Your code post isn't clear. To be clear, please edit your question, highlighting the event and then using the code tool button. That's the button that looks like the 101010.
Without more information, the JSON doesn't look standard. I would use the rex (short for regular expression) command to slice out exactly what you want into a new field.
Here's the documentation for the rex command: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Rex

Re: Extracting JSON/XML from string entry and dispalying in table

richgalloway — Sat, 02 Mar 2019 00:20:22 GMT

You've just re-posted the original question twice without fixing the error, improving the formatting, or adding clarifying information. Help us help you!