topic Re: Programmatically parse random key name in json for subfield in Splunk Search

Programmatically parse random key name in json for subfield

mmccul_fe — Wed, 11 Mar 2020 18:14:27 GMT

Data resembles this pattern.

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}"

I am trying to extract the two FQDNs when the containing field name foo{}.* is a random string. Any hints on how to get this data?

I've tried a few different options with spath and can't seem to get it to work. I could try a rex, but I was really hoping to avoid that.

Basically, what I want at the end is a field (multivalue in this case) that has as value ibar.example.com and jbar.example.com.

Re: Programmatically parse random key name in json for subfield

mmccul_fe — Wed, 11 Mar 2020 20:06:29 GMT

Why I don't want to use rex...

I have some events that have more than one foo above and I need to basically grab foo..fqdn sometimes, and later grab otherfoo..fqdn, knowing which one I am grabbing.

Re: Programmatically parse random key name in json for subfield

anmolpatel — Thu, 12 Mar 2020 05:38:35 GMT

@mmccul_fe like this?

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}" 
| spath 
| rename foo{}.* as * randstring*.fqdn as randstring*
| eval fqdn = ""
| foreach randstring* [eval fqdn = fqdn + " " + '<<FIELD>>']

Note: the screenshot is an older image, i've renamed column3 "randstring" to fqdn in my answer

Results:

Re: Programmatically parse random key name in json for subfield

to4kawa — Thu, 12 Mar 2020 08:30:23 GMT

....
|rex max_match=0 "\"fqdn\" : \"(?<fqdn>.*?)\""

Re: Programmatically parse random key name in json for subfield

anmolpatel — Fri, 13 Mar 2020 01:16:38 GMT

such a neat solution 🙂

Re: Programmatically parse random key name in json for subfield

woodcock — Sat, 14 Mar 2020 21:37:30 GMT

Like this:

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}"
| kv
| foreach *fqdn [ eval mvfield=mvappend(mvfield, '<<FIELD>>') ]

This way, as long as the fields end in fqdn, you get them merged into a field called mvfield.