topic Adding additional field from one json field. in Splunk Search

Adding additional field from one json field.

jankappe — Fri, 07 Apr 2017 06:54:12 GMT

Hi all,

I just started discovering Splunk. I am extracting a file containing JSON data. The data looks something like this:

"DevEUI_uplink": {
        "AckRequested": "1",
        "DevLrrCnt": "5",
        "rawMacCommands": "",
        "Late": "0",
        "ADRbit": "1",
        "LrrLON": "6.440177",
        "payload_hex": "00a0723a032805af1eb9006d4a9b000000",
        "Channel": "LC1",
        "FPort": "4",
        "DevAddr": "15293375"

It's a lot longer but you get the idea. Splunk extracts the field fine however "payload_hex" contains data that needs to be extracted into multiple fields. For example the last for characters will be the temperature. Is it possible to do this? If so, where would I do this and how?

EDIT: suggestions about where to learn this or specific tutorials are welcome as well.

Any help is much appreciated!

Re: Adding additional field from one json field.

hardikJsheth — Fri, 07 Apr 2017 12:28:38 GMT

You can do it by adding search time extraction in props.conf.
i.e EVAL-temprature= substr(DevEUI_uplink. payload_hex,0,4)

You can also write REGEX as well. Please refer docs at
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles

Re: Adding additional field from one json field.

jankappe — Fri, 07 Apr 2017 12:33:33 GMT

Thank you, i will look into it!

Re: Adding additional field from one json field.

DalJeanis — Fri, 07 Apr 2017 15:48:37 GMT

If that solved your issue, please accept the answer. If it was helpful but did not completely solve the issue, then you can upvote it instead.