topic Index JSON data in Splunk Search

Index JSON data

vasanthmss — Thu, 11 Dec 2014 04:51:45 GMT

Hi all,

I would like to index JSON data like this, My ultimate aim is to move the fields(college, university, examdate) to the individual array element and index.

 college=college1    studentname=name1    mark=98    subject=science    university=university1    examdate=10-12-14
 college=college1    studentname=name2    mark=99    subject=science    university=university1    examdate=10-12-14
 college=college2    studentname=name21    mark=80    subject=science    university=university1    examdate=10-12-14
 college=college2    studentname=name22    mark=100    subject=science    university=university1   examdate=10-12-14

Sample JSON,

{
   "studentsmarks": {
     "subject": "science",
     "university": "university1",
     "examdate": "10-12-14"
   },
   "students": [
     {
       "college": "college1",
       "studentname": "name1",
       "mark": "98"
     },
     {
       "college": "college1",
       "studentname": "name2",
       "mark": "99"
     },
     {
       "college": "college2",
       "studentname": "name21",
       "mark": "80"
     },
     {
       "college": "college2",
       "studentname": "name22",
       "mark": "100"
     }
   ]
 }

Cheeerrss!

Re: Index JSON data

fdi01 — Mon, 28 Sep 2020 18:22:54 GMT

run this search :
| gentimes start=-1 | eval temp="{\"studentsmarks\":{\"subject\":\"science\",\"university\":\"university1\",\"examdate\":\"10-12-14\"},\"students\":[{\"college\":\"college1\",\"studentname\":\"name1\",\"mark\":\"98\"},{\"college\":\"college1\",\"studentname\":\"name2\",\"mark\":\"99\"},{\"college\":\"college2\",\"studentname\":\"name21\",\"mark\":\"80\"},{\"college\":\"college2\",\"studentname\":\"name22\",\"mark\":\"100\"}]}" | table temp | rename temp as _raw | spath | rename students{}.* as * |rename studentsmarks.* as * | eval temp=mvzip(college,mvzip(mark,studentname,"#"),"#") | mvexpand temp | rex field=temp "(?.*)#(?.*)#(?.*)" |table college university examdate | outputcsv your_csv_name

after go to /splunk_home/var/run/splunk/ directry and you shall see your_csv_name.csv ;
Then you Recuper in the directory your csv file and you can index your_csv_name.csv file

Re: Index JSON data

vasanthmss — Tue, 16 Dec 2014 19:02:37 GMT

Hey,

How this will help me? are you ask me to index twice? then what happen to the license?

I would like to handle it in index time.