How to parse JSON like-data with extracted server name as a column?

modulussplunk — Tue, 13 Jun 2023 13:17:08 GMT

Howdy

We've got this data:

Each log line is like:

{"serverX.somedom.com" : {"key.value.pair1": "0", "key.value.pair2": "1", "key.value.pair3": "2" }}

How can I access any of key value pairs I want and use the serverX.somedom.com as well?

To produce something like:

|serverX.somedom.com|0|1|"time"

I've looked for lots of JSON and/or spath commands/post but I'm needing some more knowledge here..

Thanks!

Re: Parsing JSON like-data with extracted server name as a column?

modulussplunk — Mon, 12 Jun 2023 15:56:12 GMT

BTW, I could 'hack' this by using split and mvindex but that seems very hackish...like grep/sed/awk...I am trying to actually understand how to to this 'properly.

topic How to parse JSON like-data with extracted server name as a column? in Splunk Search

How to parse JSON like-data with extracted server name as a column?

Re: Parsing JSON like-data with extracted server name as a column?