topic Re: Not able to use JSON fields in search in Splunk Search

Not able to use JSON fields in search

sabari80 — Wed, 11 Jan 2023 15:55:41 GMT

This is my sample event

onlinequoteinguser 2023-01-11T10:27:13,843 INFO DigitalPortal.xxxeSubmissionUtil
{"hostName": "xxx80hlxxda044",
"SourceSystem": "null",
"level": "INFO",
"message": "Start | newSubmission",
"serverId": "prod-xxx_xx78",
"userId": "onlinequoteinguser",
"contextMap": [
{"JsonRpcId":"b55296cf-81e1-4xxx-8064-052dxx416725_5"},
{"methodName":"createOrUpdateDraftSubmission"},
{"traceabilityID":"7cxxx367-09aa-4367-87d4-b120526xxxcb"},
{"requestPath":"\/edge\/xxxquoteflow\/letsgetstarted"}],
"applicationName": "xx",
"timestamp": "20230111T102713.841-0500"}

here is my query to retrieve specific event based my my JSON field

index=app_xx Appid="APP-xxxx" Environment=PROD "contextMap{}.methodName"="createOrUpdateDraftSubmission"

How to make appropriate search?

Re: Not able to use JSON fields in search

richgalloway — Wed, 11 Jan 2023 18:47:39 GMT

Please share the props.conf settings for that sourcetype.

Re: Not able to use JSON fields in search

yuanliu — Wed, 11 Jan 2023 18:52:35 GMT

A job for spath. But first, you need to separate the JSON object.

| eval eSubmission = replace(_raw, "onlinequoteinguser .*eSubmissionUtil", "") | spath input=eSubmission | fields - data eSubmission

Your sample data gives

sourceSystem	applicationName	contextMap{}.JsonRpcId	contextMap{}.methodName	contextMap{}.requestPath	contextMap{}.traceabilityID	hostName	level	message	serverId	timestamp	userId
null	xx	b55296cf-81e1-4xxx-8064-052dxx416725_5	createOrUpdateDraftSubmission	/edge/xxxquoteflow/letsgetstarted	7cxxx367-09aa-4367-87d4-b120526xxxcb	xxx80hlxxda044	INFO	Start \| newSubmission	prod-xxx_xx78	20230111T102713.841-0500	onlinequoteinguser

Here is the emulation I used. You can play with it and compare to real data.

| makeresults | fields - _time | eval data = "onlinequoteinguser 2023-01-11T10:27:13,843 INFO DigitalPortal.xxxeSubmissionUtil {\"hostName\": \"xxx80hlxxda044\", \"SourceSystem\": \"null\", \"level\": \"INFO\", \"message\": \"Start | newSubmission\", \"serverId\": \"prod-xxx_xx78\", \"userId\": \"onlinequoteinguser\", \"contextMap\": [ {\"JsonRpcId\":\"b55296cf-81e1-4xxx-8064-052dxx416725_5\"}, {\"methodName\":\"createOrUpdateDraftSubmission\"}, {\"traceabilityID\":\"7cxxx367-09aa-4367-87d4-b120526xxxcb\"}, {\"requestPath\":\"\/edge\/xxxquoteflow\/letsgetstarted\"}], \"applicationName\": \"xx\", \"timestamp\": \"20230111T102713.841-0500\"}" ``` data emulation above ```