topic Splunk search- How to extract payload? in Splunk Search

Splunk search- How to extract payload?

Sanjana — Thu, 06 Oct 2022 13:54:13 GMT

Hello ,

I have splunk logger line like below:

Address: XXX HttpMethod: POST Headers: {Ama-Internal-REST-Service=hotel/booking, , Ama-Internal-Protocol=HTTP, Message-Type=RPWREQ} Payload: {"channel":"noChannel","conversationId":"12345","version":"1.0","agent":"noAgent","date":"2023-01-01","events":[{"action":"Update","objectAfter":{"chainCode":"BLR","brandCode":"ES","propertyCode":"HYATT"},"type":"Property"}]}

I need to extract payload after Payload:

And then stats as table where columns are all field in payload.
for eg:

TABLE OUTPUT:

channel conversationId version date chaincode propertycode type

Re: Splunk search

gcusello — Thu, 06 Oct 2022 12:45:05 GMT

Hi @Sanjana,

this seems to be a json log, so the spath command should extract all the fields.

In this case try something like this:

<your_search> | spath | table channel conversationId version date chaincode propertycode type

I'm not sure about the field names, check them after spath execution.

Ciao.

Giuseppe

Re: Splunk search- How to extract payload?

yuanliu — Fri, 07 Oct 2022 00:47:46 GMT

The raw data is not in JSON format, so you need to extract that Payload piece first.

| rex "Payload:\s*(?<Payload>.+)" | spath input=Payload