All Apps and Add-ons

How to extract the data present in curly braces {} in Splunk Search?

zen29d
Explorer

If the data present in json format {[]} get extracted, however when data present in {} as shown below doesn't behave same. How fields and values can be extracted from data in {}

_raw data:

{"AlertEntityId": "abc@domai.com", "AlertId": "21-3-1-2-4--12", "AlertType": "System", "Comments": "New alert", "CreationTime": "2022-06-08T16:52:51", "Data": "{\"etype\":\"User\",\"eid\":\"abc@domai.com\",\"op\":\"UserSubmission\",\"tdc\":\"1\",\"suid\":\"abc@domai.com\",\"ut\":\"Regular\",\"ssic\":\"0\",\"tsd\":\"Jeff Nichols <jeff@Nichols.com>\",\"sip\":\"1.2.3.4\",\"srt\":\"1\",\"trc\":\"abc@domai.com\",\"ms\":\"Grok - AI/ML summary, case study, datasheet\",\"lon\":\"UserSubmission\"}"}

When I perform query "| table Data", I get the below result, But how to get values of "eid", "tsd".

{"etype":"User","eid":"abc@domai.com","op":"UserSubmission","tdc":"1","suid":"abc@domai.com","ut":"Regular","ssic":"0","tsd":"Jeff Nichols <jeff@Nichols.com>","sip":"1.2.3.4","srt":"1","trc":"abc@domai.com","ms":"Grok - AI/ML summary, case study, datasheet","lon":"UserSubmission"}

Labels (2)
Tags (2)
0 Karma

zen29d
Explorer

Requirement is 
Data.eid should give the value "abc@domai.com"
Data.tsd should give the value "Jeff Nichols<jeff@Nichols.com>"

I tried above query with below combination, but none of them give result.
| spath input=Data 
| spath output=sender path=Data.tsd

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| spath input=Data
0 Karma

zen29d
Explorer

Not working.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In what way?

0 Karma

zen29d
Explorer

Requirement is 
Data.eid should give the value "abc@domai.com"
Data.tsd should give the value "Jeff Nichols<jeff@Nichols.com>"

I tried above query with below combination, but none of them give result.
| spath input=Data 
| spath output=sender path=Data.tsd

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| fields - _time
| eval _raw="{\"AlertEntityId\": \"abc@domai.com\", \"AlertId\": \"21-3-1-2-4--12\", \"AlertType\": \"System\", \"Comments\": \"New alert\", \"CreationTime\": \"2022-06-08T16:52:51\", \"Data\": \"{\\\"etype\\\":\\\"User\\\",\\\"eid\\\":\\\"abc@domai.com\\\",\\\"op\\\":\\\"UserSubmission\\\",\\\"tdc\\\":\\\"1\\\",\\\"suid\\\":\\\"abc@domai.com\\\",\\\"ut\\\":\\\"Regular\\\",\\\"ssic\\\":\\\"0\\\",\\\"tsd\\\":\\\"Jeff Nichols &lt;jeff@Nichols.com&gt;\\\",\\\"sip\\\":\\\"1.2.3.4\\\",\\\"srt\\\":\\\"1\\\",\\\"trc\\\":\\\"abc@domai.com\\\",\\\"ms\\\":\\\"Grok - AI/ML summary, case study, datasheet\\\",\\\"lon\\\":\\\"UserSubmission\\\"}\"}"
| spath
| spath input=Data
| eval tsd=replace(tsd,"&lt;","<")
| eval tsd=replace(tsd,"&gt;",">")

zen29d
Explorer

Thanks for the help.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...