topic Extract JSON fields in mixed data structure with props in Splunk Search

Extract JSON fields in mixed data structure with props

_smp_ — Sat, 07 Oct 2017 04:31:54 GMT

I have an event with a mix of JSON and non-JSON data. I have successfully extracted a Payload field with props whose value is a JSON data structure. Then using the search | spath input=Payload, the value is successfully parsed into KV pairs. But how do I move this to a config file for automatic extraction? I was looking at an EVAL- statement with the spath() function, but it's not clear what the "Y" value should be if I want to extract all of the fields, not just a specific one:

EVAL-Payload = spath(Payload, "*")

Re: Extract JSON fields in mixed data structure with props

faguilar — Tue, 21 May 2019 10:39:42 GMT

Hi @scottprigge
I have the same issue here with a JSON payload, but I couldn't figure out how to extract the data on the JSON field to make the data search. Can you show me how you manage to get the data of the JSON payload within the props?

one of my events:

05/18/2019 00:00:00 +0200, info_search_time=1558442780.272, application=axo, createDate="01/01/2019", description=mydesc, id=123456789, results="{\"results\":{\"myDate\":\"27/04/2019\",\"myId\":\"3215AAA_24369\",\"myClientId\":\"12345\",\"myType\":\"Total\"}}"

My props.conf for this sourcetype:

[extract_json]
REGEX = \"(?<field>[^\"]+)\":\"(?<value>[^\"]+)
FORMAT= "$1"::"$2"
WRITE_META = true

I couldn't make this thing work.

Thank you!!

Re: Extract JSON fields in mixed data structure with props

koshyk — Tue, 21 May 2019 10:48:10 GMT

Re: Extract JSON fields in mixed data structure with props

koshyk — Tue, 21 May 2019 10:52:01 GMT

@faguilar , please find the similar post below

Re: Extract JSON fields in mixed data structure with props

faguilar — Tue, 21 May 2019 13:12:15 GMT

Thank you @koshyk!!! Sorry I didn't saw the answer

Re: Extract JSON fields in mixed data structure with props

koshyk — Wed, 22 May 2019 16:16:04 GMT

no probs. if it has helped you, please upvote/accept. cheers