JSON extraction needed

mbasharat — Tue, 18 Feb 2025 21:36:02 GMT

Hi. I have below raw event/s.

Highlighted Syntax:
{ [-]
   body: {"isolation": "isolation","device_classification": "Network Access Control","ip": "1.2.3.4", "mac": "Unknown","dns_hn": "XYZ","policy": "TEST_BLOCK","network_fn": "CounterACT Device","os_fingerprint": "CounterACT Appliance","nic_vendor": "Unknown Vendor","ipv6": "Unknown",}
   ctupdate: notif
   eventTimestamp: 1739913406
   ip: 1.2.3.4
   tenant_id: CounterACT__sample
}

Raw Text:
{"tenant_id":"CounterACT__sample","body":"{\"isolation\": \"isolation\",\"device_classification\": \"Network Access Control\",\"ip\": \"1.2.3.4\", \"mac\": \"Unknown\",\"dns_hn\": \"XYZ\",\"policy\": \"TEST_BLOCK\",\"network_fn\": \"CounterACT Device\",\"os_fingerprint\": \"CounterACT Appliance\",\"nic_vendor\": \"Unknown Vendor\",\"ipv6\": \"Unknown\",}","ctupdate":"notif","ip":"1.2.3.4","eventTimestamp":"1739913406"}

I need below fields=value extracted from each event at search time. It is a very small dataset:

isolation=isolation
policy=TEST_BLOCK
ctupdate=notif
ip=1.2.3.4
ipv6=Unknown
mac=Unknown
dns_hn=XYZ
eventTimestamp=1739913406

Thank you in advance!!!

Re: JSON extraction needed

livehybrid — Tue, 18 Feb 2025 22:21:57 GMT

Hi @mbasharat

Add "| spath input=body" to your SPL - this will then extract the fields within the body JSON key as keyval fields in your results.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: JSON extraction needed

mbasharat — Tue, 18 Feb 2025 22:35:38 GMT

Thank you @livehybrid !!!!! I knew I was dosing off at the end of the day.... LOL

topic Re: JSON extraction needed in Splunk Search

JSON extraction needed

Re: JSON extraction needed

Re: JSON extraction needed