topic Re: How to extract mutiple value from json in Splunk Search

How to extract mutiple value from json

zhenqi — Fri, 01 Jul 2022 09:44:36 GMT

Hi,

I want to extract judgments to a fields from "37.0.10.15" and "47.105.153.104",

Is there any way it can do that?

{"data":{"37.0.10.15":{"severity":"medium","judgments":["Scanner","Zombie","Spam"],"tags_classes":[],"basic":{"carrier":"Delis LLC","location":{"country":"The Netherlands","province":"Zuid-Holland","city":"Brielle","lng":"4.16361","lat":"51.90248","country_code":"NL"}},"asn":{},"scene":"","confidence_level":"high","is_malicious":true,"update_time":"2022-06-20 13:00:09"},"47.105.153.104":{"severity":"high","judgments":["Zombie","IDC","Exploit","Spam"],"tags_classes":[{"tags":["Aliyun"],"tags_type":"public_info"}],"basic":{"carrier":"Alibaba Cloud","location":{"country":"China","province":"Shandong","city":"Qingdao City","lng":"120.372878","lat":"36.098733","country_code":"CN"}},"asn":{"rank":2,"info":"CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN","number":37963},"scene":"Hosting","confidence_level":"high","is_malicious":true,"update_time":"2022-06-27 21:11:32"}},"response_code":0,"verbose_msg":"OK"}

Re: How to extract mutiple value from json

ITWhisperer — Fri, 01 Jul 2022 11:16:13 GMT

| spath data | spath input=data | fields *.judgments{}

Re: How to extract mutiple value from json

zhenqi — Sat, 02 Jul 2022 03:10:28 GMT

thanks for your help! the result is "37.0.10.15.judgments{}" and "47.105.153.104.judgments{}", what can I do if I want to stats the two judgments to one field?

Re: How to extract mutiple value from json

ITWhisperer — Sat, 02 Jul 2022 07:20:01 GMT

Not sure what you mean by "stats the two judgments to one field, but you can combine them as a single multi-value field like this

| spath | spath input=data | fields *.judgments{} | foreach *.judgments{} [| eval judgments=if(isnull(judgments),'<<FIELD>>',mvappend(judgments,'<<FIELD>>'))]

Re: How to extract mutiple value from json

zhenqi — Sat, 02 Jul 2022 07:24:26 GMT

thanks ! I solved the problem by modifying json format,your answer helps me a lot