topic Re: Spath command to extract JSON from _raw event in Dashboards & Visualizations

Spath command to extract JSON from _raw event

sbd12b — Thu, 06 Jan 2022 19:46:06 GMT

This is the basic case:

I have an event

2021-12-28T06:24:17.567|SEARCHING|{"field1":"value1","field2":5,"field3":"la la la"}

My search

index="redact" SEARCHING | spath path="field3"

Splunk is separating the values, but field3 column is empty for all events.

Can anyone please assist?

Re: Spath command to extract JSON from _raw event

kamlesh_vaghela — Fri, 07 Jan 2022 04:42:14 GMT

@sbd12b

Try this.

index="redact" SEARCHING | rex field=_raw "(?<_raw>\{.*\})" | spath | table field3

My Sample Search :

| makeresults | eval _raw="2021-12-28T06:24:17.567|SEARCHING|{\"field1\":\"value1\",\"field2\":5,\"field3\":\"la la la\"}" | rex field=_raw "(?<_raw>\{.*\})" | spath | table field3

Thanks
KV
▄︻̷̿┻̿═━一 😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Spath command to extract JSON from _raw event

sbd12b — Fri, 07 Jan 2022 15:50:21 GMT

This worked perfect. Thank you for your help!

I had to change the "<" and ">" to entities and it worked amazing!

| rex field=_raw "(?&lt;_raw&gt;\{.*\})" |

Re: Spath command to extract JSON from _raw event

sbd12b — Fri, 07 Jan 2022 17:00:31 GMT

This worked perfect. Thank you for your help!

I had to change the "<" and ">" to entities and it worked amazing!

| rex field=_raw "(?&lt;_raw&gt;\{.*\})" |