topic Re: Can Splunk dynamically extract JSON Key names while joining the event with other sourcelogs? in Splunk Search

Can Splunk dynamically extract JSON Key names while joining the event with other sourcelogs?

lpolo — Mon, 29 Apr 2013 17:19:07 GMT

The following query is able to join two source logs where one of the source logs is in json format:

(sourcetype="request" AND application=vsp NOT (Agent.007) key_name1 )
 OR
(sourcetype="response" key_name2)
| spath
| spath path=your_json_path output=your_output_key_name1
| spath path=your_json_path output=your_output_key_name2
| spath path=your_json_path output=your_output_key_name3
...
| spath path=your_json_path output=your_output_key_name4
stats
 first(your_output_key_name1) as your_output_key_name1
 first(your_output_key_name2) as your_output_key_name2
 first(your_output_key_name3) as your_output_key_name3
 first(your_output_key_name4) as your_output_key_name4
 first(key_name1) as key1
 list(key_name2) as key2 
 dc(sourcetype) as dc by id

Problem:
JSon path could vary. Therefore, output variables too. Is there a way in Splunk that these could be discovered dynamically?

Regards,
Lp

Re: Can Splunk dynamically extract JSON Key names while joining the event with other sourcelogs?

lpolo — Thu, 09 May 2013 12:37:34 GMT

This query works:

(sourcetype="request")//sourcelog. Key=value pair format.
 OR
(sourcetype="json_response")//source og. json format.
  |spath  //spath command in auto-extract mode. 
  |stats list(*) as * by id //join source log by id.

However, I am not source if it is limited by the way spath is ran without arguments. As documented:

When spath is ran with no path argument, spath runs in "auto-extract" mode, where it finds and extracts all the fields from the first 5000 characters in the input field (which defaults to _raw if another input source isn't specified).

Re: Can Splunk dynamically extract JSON Key names while joining the event with other sourcelogs?

rgcurry — Thu, 09 May 2013 13:15:44 GMT

Have you considered using the "KV_MODE" parameter in your props.conf for this sourcetype? Check it out at http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles.

Re: Can Splunk dynamically extract JSON Key names while joining the event with other sourcelogs?

lpolo — Thu, 09 May 2013 17:35:52 GMT

It could be an option too... I have to test it.