topic Re: How to extract a JSON object which is in double quotes? in Splunk Search

How to extract a JSON object which is in double quotes?

Kukkadapu — Tue, 29 Sep 2020 08:30:44 GMT

Hi, I've a JSON object logged into splunk in double quotes. What to do to extract the JSON object using spath. How do I ignore the double quotes before doing the spath.

2016-01-20 17:40:38,076 INFO org.apache.log4j.Logger transaction_id="1234565"
Json_object = "{

"requestId": "123",

"partnerId": "asd",

"date":"01/01/2015 14:00:00"

}"
tmepId ="123"

Thanks.

Re: How to extract a JSON object which is in double quotes?

ohoppe — Tue, 29 Sep 2020 08:35:36 GMT

Hi,

here you go. The important bit is the line with the rex command. The rest of it I just used to simulate the event and present the result.

|stats count|eval count="2016-01-20 17:40:38,076 INFO org.apache.log4j.Logger transaction_id=\"1234565\"
Json_object = \"{
\"requestId\": \"123\",
\"partnerId\": \"asd\",
\"date\":\"01/01/2015 14:00:00\"
}\"
tmepId =\"123\""|

rex field=count "(?s)\"(?{.*})\""

|table count myjson|spath input=myjson

BR
Oliver

Re: How to extract a JSON object which is in double quotes?

Kukkadapu — Wed, 27 Jan 2016 16:26:18 GMT

Thanks Oliver. That worked:)

Re: How to extract a JSON object which is in double quotes?

ohoppe — Wed, 27 Jan 2016 16:30:43 GMT

Very Welcome. 🙂