topic Difficult extracting fields in Splunk Search

Difficult extracting fields

jcioffari — Wed, 09 Dec 2020 22:20:08 GMT

I have events that look like this and I am using the field extractor

"timestamp": "2020-12-09T18:05:03.6664112Z",

"scopeType": "organization", "scopeDisplayName": "1D (Organization)",

"scopeId": "920941ec-025f-4d4c-9944-e7d357de7d94",

"actionId": "Deleted",

"data": {

"ProjectName": "ATI Libs",

"RepoId": "eb1e2a37-0833-462a-b3e6-031aa1d1f006",

"RepoName": "libs-01"

I tried to extract fields using both delimited option ":" as well as using regex. When I use delimiter of "," it creates the first field 'timestamp' correctly but then lumps everything after that into a single field. When I try to use regex to extract a field, for example I highlight the value "ATI Libs", I get this error:

"The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings."

Please advise, thanks.

Re: Difficult extracting fields

ITWhisperer — Wed, 09 Dec 2020 22:32:21 GMT

This looks a bit like JSON. Is this part of a larger event? Could you use spath to extract the fields? Also, are you using max_match=0 option in your rex command to extract multiple fields?

Re: Difficult extracting fields

somesoni2 — Wed, 09 Dec 2020 23:23:43 GMT

You might need a field transform to handle this field extraction. Have a read at this Splunk documentation:

https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Exampleconfigurationsusingfieldtransforms#Configure_delimiter-based_field_extractions

Re: Difficult extracting fields

jcioffari — Thu, 10 Dec 2020 06:12:43 GMT

I've tried spath but not seeing fields getting extracted properly.