topic Convert JSON to table in Splunk Search

Convert JSON to table

splunk_skr — Mon, 29 May 2017 01:59:56 GMT

I tried looking up for a solution and went through almost all suggestions. None worked for me. I have the following json log that i want to convert to table. This is the raw representation for the json.

{"timestamp": "2017-05-28T19:34:15.698Z",
    "F_A": "valuefor_F_A",
    "F_B": "valuefor_F_B",
    "F_C": "{\"x\":\"valuefor_x\",\"y\":\"valuefor_y\",\"z\":\"valuefor_z\"}",
    "F_D": "valuefor_F_D"
}

Field F_C contains most of the info which i want to see in a table. I also need the timestamp in the table. So basically here is what i am looking for

x                   y                             z                  timestamp
=====================================================================
valuefor_x         valuefor_y       valuefor_z         2017-05-28T19:34:15.698Z

Any suggestions?

Re: Convert JSON to table

jkat54 — Mon, 29 May 2017 02:24:08 GMT

The timestamp should be auto recognized:

Here's my "down and dirty, cell phone typed answer":

 ... | rex 'x\\":\\"(?<x>.+)\\",\\"y\\":\\"(?<y>.+)\\",\\"z\\":\\"(?<z>.+)\\"}"' | table x y z _time

Re: Convert JSON to table

splunk_skr — Mon, 29 May 2017 04:45:36 GMT

Thanks,,there are syntactical errors..trying to fix now.

Re: Convert JSON to table

splunk_skr — Mon, 29 May 2017 05:11:02 GMT

Unable to make it work. any other suggestions?

Re: Convert JSON to table

jkat54 — Mon, 29 May 2017 13:17:26 GMT

Change the double slashes to triple slashes, if that don't work make them quad slashes. Sorry I couldn't test first, but I'm far away from my computer.