topic Re: How can I extract ALL occurrences of a field from JSON file? in Splunk Search

How can I extract ALL occurrences of a field from JSON file?

Sanjay71 — Mon, 23 Oct 2017 20:45:13 GMT

23.10.2017 14:01:23.745 INFO [10.87.80.251 [1508785283744] POST /apps/globallog HTTP/1.1] InfoLoggerServiceImpl {"id":{"field1":"DDDDDDD","field2":"XXXXXX","field3":"XXXXXXX","field4":"BBBBBB"},"request":{"url":"https://CCCCC-detail.html","timestamp":"2017.10.23 14:01:23.745"},"info":{"api":[{"NAME":"API1","CORRELATIONID":" VVVV","URL":"API1.json"},{"NAME":"API2","CORRELATIONID":" VVVV ","URL":"API2.json"}]}}

Was able to extract the fields as Name/Values pairs; but only the first occurrence is extracted ie. API2 is not getting extracted
From the above ONLY API1 was extractable but not "NAME":"API2","CORRELATIONID":" VVVV ","URL":"API2.json, I was assuming the below would have shown 2 URLs, 2 Names, 2 Correlation ID

URL is calling 2 APIs and only one of them seems is extracted by the below syntax

This was used to extract the name/value pairs
[json_embedded]
REGEX = "(\w+)"."(\S+?)"
FORMAT = $1::$2

Appreciate any help

Re: How can I extract ALL occurrences of a field from JSON file?

lfedak_splunk — Mon, 23 Oct 2017 21:06:31 GMT

Hey @Sanjay71, can you review your post and "XXX" out any sensitive fields? Answers is a public forum, so anyone can see this post by searching online. Specifically field 1 and 3 stood out.

Re: How can I extract ALL occurrences of a field from JSON file?

Sanjay71 — Mon, 23 Oct 2017 23:10:22 GMT

URL is calling 2 APIs and only one of them seems is extracted by the below syntax

This was used to extract the name/value pairs
[json_embedded]
REGEX = "(\w+)"."(\S+?)"
FORMAT = $1::$2

Appreciate any help

Re: How can I extract ALL occurrences of a field from JSON file?

Sanjay71 — Mon, 06 Nov 2017 17:48:40 GMT

Hi @lfedak - any thoughts on my question? Thanks

Re: How can I extract ALL occurrences of a field from JSON file?

somesoni2 — Mon, 06 Nov 2017 18:49:14 GMT

Use this for your transforms.conf entry

[json_embedded]
REGEX = "(\w+)"."(\S+?)"
FORMAT = $1::$2
REPEAT_MATCH = true
MV_ADD = true

Reference: https://answers.splunk.com/answers/484037/multi-value-field-extraction-propsconf-transformsc.html