topic Searching on a specific field in JSON in Splunk Search

Searching on a specific field in JSON

fredsnertz — Mon, 29 Apr 2024 16:57:22 GMT

This is probably an entry level question. I have raw data that looks something like this:

{"id": 99999, "type": "HOST", "timestamp": "2024-04-29T10:41:39.820Z", "entity": {"ipAddress": "1.1.1.1"}, "dataName": "Testing"}

If I search for type="HOST" or entity.ipAddress="1.1.1.1" I get this entry in the results, but if I search for dataName="Testing" or even dataName=*, I get nothing. What is different about this field?

Re: Searching on a specific field in JSON

bowesmana — Tue, 30 Apr 2024 00:41:05 GMT

There doesn't appear to be anything wrong with it - but it would require that field to be extracted so it could be searched.

Do you know if it's an indexed field or extracted at search time?

If you add | stats count by dataName to your search do you get any results - if not, then that field is not extracted.

If you run the search in verbose mode, does the dataName field show up in the fields in the left hand panel?

Re: Searching on a specific field in JSON

gcusello — Tue, 30 Apr 2024 05:35:27 GMT

Hi @fredsnertz ,

see in the interesting fields from your searh what's the real ile name of dataName field (probably entity.dataName) and use it.

Using the json format fields are composite.

Ciao.

Giuseppe