topic How do I extract a value from the the following JSON? in Splunk Search

How do I extract a value from the the following JSON?

abhishekgandhe — Thu, 06 Dec 2018 06:57:47 GMT

I want to extract the following values from below JSON. Values needs to be extracted from the highlighted text in Bold.

model-cps-kkru-qa2 , Data Reconciliation, Honeywell.PMT.UOP.CPS.UniSimTaskService.exe. 

{"message":[{"raw":"06/12/18 05:37:47 [19] INFO  :: TenantId = model-cps-kkru-qa2 :: JobId = 85db2e7e-8b6a-4482-9d0f-40d7c48c7aa1 :: CalcType = Data Reconciliation :: UniSimInvokerServices.UniSimApplicationServices : UniSim Job Run completed successfully!","severityLevel":"Informational","className":"Honeywell.PMT.UOP.CPS.UniSimTaskService.UniSimEventProcessorHost+d__23","methodName":"MoveNext","lineNumber":389,"domain":"Honeywell.PMT.UOP.CPS.UniSimTaskService.exe","loggerName":"UTELogger","threadName":"19"}],"internal":{"data":{"id":"1d75acfe-f919-11e8-b912-eb327d060bc3","documentVersion":"1.61"}},"context":{"data":{"eventTime":"2018-12-06T05:37:47.8836038Z","isSynthetic":false,"samplingRate":100.0},"cloud":{},"device":{"type":"PC","roleInstance":"usd-qa-wk2-eus","screenResolution":{}},"session":{"isFirst":false},"operation":{},"location":{"clientip":"0.0.0.0","continent":"North America","country":"United States","province":"Virginia","city":"Boydton"},"custom":{"dimensions":[{**"TenantId":"model-cps-kkru-qa2"**},{"LoggerName":"UTELogger"},{**"CalcType":"Data Reconciliation"**},{"JobId":"85db2e7e-8b6a-4482-9d0f-40d7c48c7aa1"},{"MethodName":"MoveNext"},{"LineNumber":"389"},{**"Domain":"Honeywell.PMT.UOP.CPS.UniSimTaskService.exe"**},{"ThreadName":"19"},{"ClassName":"Honeywell.PMT.UOP.CPS.UniSimTaskService.UniSimEventProcessorHost+d__23"},{"FileName":"C:\\Users\\E542204\\Source\\Repos\\cps-unisim-taskexecutor\\Honeywell.PMT.UOP.CPS.UniSimTaskExecutor\\UniSimEventProcessorHost.cs"}]}}}

Re: How do I extract a value from the the following JSON?

harsmarvania57 — Thu, 06 Dec 2018 13:50:51 GMT

Hi,

As this is full JSON event, you can index this data with below configuration on Universal Forwarder and splunk will automatically extract all fields present in JSON data.

props.conf

[yoursourcetype]
INDEXED_EXTRACTIONS = JSON

If you want to extract event at Search time you can use below query.

<yourBaseSearch> | spath

This will extract data in fields context.custom.dimensions{}.TenantId, context.custom.dimensions{}.CalcType and context.custom.dimensions{}.Domain

Re: How do I extract a value from the the following JSON?

jpolvino — Thu, 06 Dec 2018 21:21:30 GMT

If you want to get just those 3, you can do this inline:

| eval TenantId=spath(json,"context.custom.dimensions.[TenantId]")
| eval CalcType=spath(json,"context.custom.dimensions.[CalcType]")
| eval Domain=spath(json,"context.custom.dimensions.[Domain]")

Not 100% sure about the brackets though.