topic Re: json parsing in Splunk Search

json parsing

onthakur — Mon, 22 Nov 2021 14:41:00 GMT

I have logs in below format, which is mix of delimiter (|) and json. now I want to extract statuscode and statuscodevalue and create table with columns _time,statuscodevalue,statuscode.

can someone please help me ?

2021-11-22 05:52:09.755 INFO - c.t.c.a.t.service.UserInfoService(101) - abcd | abcd-APP | /user-info | af4772c0-1fcd-4a82-858e-c2f7f0821724 | APP |
-| Response of validateAddress abcd Service: {
"headers" : { },
"body" : {
"baseError" : {
"code" : "3033",
"reason" : "User is unauthorized",
"explanation" : "Unauthorized"
}
},
"statusCode" : "UNAUTHORIZED",
"statusCodeValue" : 401
}

Re: json parsing

ITWhisperer — Mon, 22 Nov 2021 15:44:42 GMT

| makeresults | eval _raw="2021-11-22 05:52:09.755 INFO - c.t.c.a.t.service.UserInfoService(101) - abcd | abcd-APP | /user-info | af4772c0-1fcd-4a82-858e-c2f7f0821724 | APP | -| Response of validateAddress abcd Service: { \"headers\" : { }, \"body\" : { \"baseError\" : { \"code\" : \"3033\", \"reason\" : \"User is unauthorized\", \"explanation\" : \"Unauthorized\" } }, \"statusCode\" : \"UNAUTHORIZED\", \"statusCodeValue\" : 401 }" | eval _time=strptime(_raw,"%F %T.%Q") | rex "(?ms)Service: (?<response>.*)" | spath input=response statusCode | spath input=response statusCodeValue | table _time statusCodeValue statusCode