topic Filter data from json file in Splunk Search

Filter data from json file

drogo — Thu, 14 Nov 2024 13:36:03 GMT

Team,
I am bit new to Splunk, need help to pull ERR message from below sample raw data.

{"hosting_environment": "nonp", "application_environment": "nonp", "message": "[20621] 2024/11/14 12:39:46.899958 [ERR] 10.25.1.2:30080 - pid:96866" - unable to connect to endpoint , "service": "hello world"}

Thanks!

Re: Filter data from json file

ITWhisperer — Thu, 14 Nov 2024 13:42:49 GMT

This is a bit vague - Do you want to search for events that have ERR in? Do you want to extract what comes after "[ERR}" in the message field? Do you already have these JSON fields extracted?

Re: Filter data from json file

gcusello — Thu, 14 Nov 2024 13:46:20 GMT

Hi @drogo ,

if you use the INDEXED_EXTRACTIONS=JSON option for the sourcetype you're using for those data, you have all the fileds extracted.

If you don't see this field, youcan use a regex to extract it:

| rex "\d*\s\[(?<message>[^\]]+)"

that you can test at https://regex101.com/r/QcGAwT/1

Ciao.

Giuseppe

Re: Filter data from json file

yuanliu — Fri, 15 Nov 2024 06:41:06 GMT

If your events are truly in JSON, you are asking the wrong question. Let me explain.

The sample you illustrated above is not JSON compliant. Specifically, quotation marks are badly placed. So, the most important question is whether the sample is faithful. Or do you mean a compliant JSON like this:

{"hosting_environment": "nonp", "application_environment": "nonp", "message": "[20621] 2024/11/14 12:39:46.899958 [ERR] 10.25.1.2:30080 - pid:96866 - unable to connect to endpoint", "service": "hello world"}

Assuming your raw events are JSON compliant, Splunk would give you a field named message. The task is simply to extract the desired part from this field. In other words, the fact that data is JSON should have no bearing on your question. If I read your mind correctly, you want the string after [ERR]. (I'm not joking about reading mind. You should always illustrate what you want using sample data.) Therefore

| rex field=message "\[ERR\] (?<error>.+)"

If, on the other hand, your raw events are mangled like in your illustration, the answer will depend on how badly mangled the events are. The best solution would be to implore your developers to fix the log.

Either way, the question is really not about JSON.