topic How to extract value from JSON then declare a variable? in Splunk Search

How to extract value from JSON then declare a variable?

yiweishih — Mon, 04 Apr 2022 14:39:34 GMT

I have HEC to send an event to Splunk in JSON format:

{ Status: Down Source: GCP URL: url_1 } { Status: Up Source: GCP URL: url_2 } { Status: Down Source: AWS URL: url_1 } { Status: Up Source: AWS URL: url_2 }

I want to extract value from JSON then declare a variable, not sure should I use eval or stats
For example:
declare a variable usl_1_aws_status, it should be Down
declare a variable usl_2_gcp_status, it should be UP

How to do I extract value from JSON then declare a variable?

Re: How to extract value from JSON then declare a variable

yuanliu — Sat, 02 Apr 2022 07:33:25 GMT

The easiest is perhaps transpose.

| eval site_status=URL . "_" . Source . "_status" | table site_status Status | transpose header_field=site_status | fields - column

The sample data gives

url_1_GCP_status	url_2_GCP_status	url_1_AWS_status	url_2_AWS_status
Down	Up	Down	Up

Re: How to extract value from JSON then declare a variable

yiweishih — Sat, 02 Apr 2022 08:02:45 GMT

It worked!! Thank you so much!