topic Re: Extracting fields from nested JSON event in Splunk Search

Extracting fields from nested JSON event

kmaron — Thu, 03 Dec 2020 20:46:17 GMT

I have a very complex nested JSON event and need to extract 2 fields. I've managed it with less complicated ones but this one has be a bit stumped.

I need to get the avgCycles and totalExecutions for each iRule - keeping hold of the name of the iRule.

My event looks like this:

{ [-] clientSslProfiles: { [+] } deviceGroups: { [+] } httpProfiles: { [+] } iRules: { [-] /Department/Shared/Department_HTML_rewrite_Rule: { [-] application: Shared events: { [-] CLIENT_ACCEPTED: { [+] } HTML_TAG_MATCHED: { [+] } HTTP_REQUEST: { [+] } HTTP_RESPONSE: { [-] aborts: 0 avgCycles: 28338 failures: 0 maxCycles: 1882653 minCycles: 8898 priority: 550 totalExecutions: 86269 } } name: /Department/Shared/Department_HTML_rewrite_Rule tenant: Department } /Common/Office-Rule: { [+] } /Common/Debug-Rule: { [+] .....

Re: Extracting fields from nested JSON event

to4kawa — Sat, 05 Dec 2020 07:00:53 GMT

Why don't you spath and table?

Re: Extracting fields from nested JSON event

kmaron — Mon, 07 Dec 2020 13:02:04 GMT

@to4kawa I can spath but I have no idea how many iRules there will be per event or what they are named, and I don't know how many event types there will be or what they are named.

Re: Extracting fields from nested JSON event

to4kawa — Tue, 08 Dec 2020 08:30:54 GMT

The command cannot be applied firmly because there is no log of _raw, but spath output= should be fine.

I don't Re: Extracting fields from nested JSON event

kmaron — Tue, 08 Dec 2020 13:12:52 GMT

I don't understand what you're saying. I need to pull out only the avgCycles and totalExecutions for every iRule, attached to the name of the iRule. but I do not know how many there are, or what they are named. spath is just the start. It doesn't do the extraction or allow me to isolate those fields when I don't know the iRule names.

Re: I don't Re: Extracting fields from nested JSON event

to4kawa — Tue, 08 Dec 2020 21:21:36 GMT

I can't make a regular expression because you're only presenting the processed log. Also, there are no multiple logs.