All Apps and Add-ons

Renaming host field in JSON event from azure metrics

darkwingii
New Member

I am ingesting azure metrics data using the TA-MS-AAD app
but the data has a host field
{ [-]
_time: 2020-03-26T08:09:00Z
average: 2.8653846153846154
host: /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/xxxxxxxxxxx/providers/Microsoft.Web/serverFarms/xxxxxxxxxxxxx
metric_name: CpuPercentage
namespace: microsoft.web/serverfarms
subscription_id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
unit: Percent
}

I want to be able to group results by JSON host and not have the results polluted by server host name
field extraction doesn't work 100% because the host field can be in different places in the raw text for the same metric

2 Examples

{"metric_name": "CpuPercentage", "average": 0.65625, "_time": "2020-03-26T08:22:00Z", "host": "/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Web/serverFarms/xxx", "namespace": "microsoft.web/serverfarms", "unit": "Percent", "subscription_id": "xxx"}

{"subscription_id": "xxx", "host": "/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Web/serverFarms/xxx", "metric_name": "CpuPercentage", "unit": "Percent", "_time": "2020-03-26T07:51:00Z", "average": 0.0, "namespace": "microsoft.web/serverfarms"}

field alias just renames all host field names, unless there is a way to differentiate between the 2

any help is most appreciated

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="raw
{\"metric_name\": \"CpuPercentage\", \"average\": 0.65625, \"_time\": \"2020-03-26T08:22:00Z\", \"host\": \"/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Web/serverFarms/xxx\", \"namespace\": \"microsoft.web/serverfarms\", \"unit\": \"Percent\", \"subscription_id\": \"xxx\"},
{\"subscription_id\": \"xxx\", \"host\": \"/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Web/serverFarms/xxx\", \"metric_name\": \"CpuPercentage\", \"unit\": \"Percent\", \"_time\": \"2020-03-26T07:51:00Z\", \"average\": 0.0, \"namespace\": \"microsoft.web/serverfarms\"}"
| multikv forceheader=1
| spath
| fields - _raw raw

For this result, if LINE_BREAKER is good, field extraction is no problem.
check your props.conf and transforms.conf

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...