topic Parsing string with whitespaces as json object in Splunk Search

Parsing string with whitespaces as json object

mipa04 — Mon, 27 May 2024 18:13:41 GMT

Hi, I am completely new to splunk and have to parse field that looks like this:
params="['field1: value1', 'field2: value2', 'field3: value3']" (note spaces after colons) - I have to extract field1, field2, field3 to be searchable - can you help with what query should I write?

Re: Parsing string with whitespaces as json object

ITWhisperer — Mon, 27 May 2024 22:35:14 GMT

That isn't a JSON object, so you could try using rex to parse it - you could try something like this

| rex max_match=0 "'(?<field>\w+:\s[^']+)'" | mvexpand field | rex field=field "(?<name>\w+):\s(?<value>.*)" | eval {name} = value | fields - name value | stats values(*) as * by _raw

Re: Parsing string with whitespaces as json object

yuanliu — Wed, 29 May 2024 04:42:58 GMT

Like @ITWhisperer said, this is not JSON. AND a strange choice of data format. How to extract what you need depends quite on string values of "field1" "field2", "value1", "value2", etc. If none of "fieldN", "valueN" contains hard breakers such as white space, you do something as simple as

| rex mode=sed field=params "s/: */=/g" | rename _raw as temp, params AS _raw | kv | rename temp AS _raw

(I assume that you already have the field params.)

If the data is more complex than that, you will need to reconstruct data. One way is to convert the structure into conformant JSON. For example,

| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/" | spath input=params

Here is a complete emulation

| makeresults | fields - _* | eval params = "['field1: value1', 'field2: value2', 'field3: value3']" | rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/" | spath input=params

field1	field2	field3	params
value1	value2	value3	{"field1":"value1", "field2":"value2", "field3":"value3"}