topic Re: Field-extraction on a JSON message with multiple delimiters? in Splunk Search

Field-extraction on a JSON message with multiple delimiters?

jayakumar89 — Fri, 01 Dec 2017 17:57:19 GMT

I have this:

{"date": null, "facility": -1, "host": null, "level": -1, "message": "2017-11-13T03:45:00+0000 monStatsLog, applianceName=xxxxx, tenantName=xxxx, mstatsTimeBlock=1510544700, tenantId=1, vsnId=0, mstatsTotSentOctets=250, mstatsTotRecvdOctets=0, mstatsTotSessDuration=26001, mstatsTotSessCount=1, mstatsType=sdwan-acc-ckt-app-stats, mstatsId=tftp:Controller1:MPLS:1:2, mstatsAttribs=1:3:general-internet:file-server:Unknown", "charset": "UTF-8", "remote_address": "xxxxxxx", "hostname": "xxxxxx"}

I'm trying to parse a json file with entries like above, where the message field has multiple values, which are in turn delimited using comma and =. How can I parse that specific field to extract all the information?

Re: Field-extraction on a JSON message with multiple delimiters?

woodcock — Sat, 02 Dec 2017 21:33:24 GMT

Assuming that your JSON is coherent and being processed correctly you should already have a message field so just do this:

| makeresults 
| eval message="2017-11-13T03:45:00+0000 monStatsLog, applianceName=xxxxx, tenantName=xxxx, mstatsTimeBlock=1510544700, tenantId=1, vsnId=0, mstatsTotSentOctets=250, mstatsTotRecvdOctets=0, mstatsTotSessDuration=26001, mstatsTotSessCount=1, mstatsType=sdwan-acc-ckt-app-stats, mstatsId=tftp:Controller1:MPLS:1:2, mstatsAttribs=1:3:general-internet:file-server:Unknown"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rename message AS _raw
| kv

Re: Field-extraction on a JSON message with multiple delimiters?

jayakumar89 — Mon, 04 Dec 2017 17:34:01 GMT

It helped. Thanks!