topic Re: Extract key-value pair from json object in Splunk Search

How to extract key-value pair from json object?

itnewbie — Mon, 14 Aug 2023 17:45:19 GMT

I have a JSON event like this:

{ ...otherfields..., "fields": { "id1": 123, "id2": 456, "id3": 789, ... }, ...otherfields... }

I want to extract some key-value pairs from the "fields" object, i.e., I want to see the extracted fields in the "interesting fields" section.

For example, if I only want to extract id1 and id3, I should use

eval new_id1 = mvindex(fields.id1, 0) eval new_id3 = mvindex(fields.id3, 0)

, right? Or is there another efficient way but not to use Foreach? I am new to the Splunk syntax so would appreciate any help.

ITWhisperer — Mon, 14 Aug 2023 14:59:44 GMT

Try something like this

| spath fields.id1 output="new_id1" | spath fields.id3 output="new_id3"

N.B. The spath command is built for extracting fields from JSON (and XML) structured data.

yuanliu — Mon, 14 Aug 2023 17:00:02 GMT

mvindex wouldn't do anything to single valued fields.id1, fields.id3, etc. To limit fields of interest, use fields command.

| fields fields.id1 fields.id3

If you only want to display these fields in statistics tab, use table command.