topic Re: can't extract field in json in Splunk Search

can't extract field in json

efrenette11 — Tue, 28 Jul 2015 14:55:49 GMT

Hi,

I try to extract fields fron this json. I've tried with jsonkv and spath and it looks like that ' does generate problem during the extraction.

{'idFromSource':'344064','id':{'tmonline-us':{'id':'344064'}},'name':{'en-us':'NOVENUE'},'city':{'id':{},'name':{}},'timezone':'America/Los_Angeles','dma':[],'market':[],'image':[],'isTest':false,'source':'tmonline-us','idFromSource':'344064'}

Any suggestion ?

Re: can't extract field in json

somesoni2 — Tue, 28 Jul 2015 15:15:50 GMT

When ingested in Splunk what sourcetype definition you've used? (props.conf on Indexer/Heavy Forwarder)

Re: can't extract field in json

efrenette11 — Tue, 28 Jul 2015 15:20:37 GMT

In fact there's no specific source type defined as a log loune is not all in json format. Only the payload has json as format.

Is a result this request.
host="*cops.jetdev2.syseng.tmcs" appCode="jms.send" | table payload

Re: can't extract field in json

efrenette11 — Tue, 28 Jul 2015 15:21:21 GMT

I'm currently tryin to replace ' with " in the payload, but I always obtain UNBALACED QUOTES as error message.

Re: can't extract field in json

somesoni2 — Tue, 28 Jul 2015 15:34:09 GMT

I think the single quotes are causing issues. Give this a try:- (replacing single quotes with double quotes)

host="*cops.jetdev2.syseng.tmcs" appCode="jms.send" | table payload | eval payload=replace(payload,"'","\"") | spath input=payload

Re: can't extract field in json

aljohnson_splun — Tue, 28 Jul 2015 15:34:50 GMT

Is this the actual json data? I tried linting it and it failed. http://jsonlint.com/ . Also, have you tried using KV_MODE=JSON inprops.conf ?