Archive

Exracting a json field data from a log

Path Finder

Hi All,

I am trying to extact a JSON field from the log. I can able to get the data by using "spath input" command. Can you help me with this command's configuration in the back end file so that it can automatically do the job.

search query :

index=*|spath input=<JSON field name>

I need to update this search in props.conf / transforms.conf.

Please find more details about it from the sample log below as I can see it's bit confusing.

"Master_field": "value", "Master_field": "{\"field1\":\"***\",\"field2\":\"value2\",\"field3\":\"value3\",\"field4\":\"value4\",\"field5\":\"{value5}\",\"field6\":\"value6\"},"Master_field": "value"}

Here is the raw data I'm getting in the events. Master fields have been parsed successfully. But the sub fields are not able to parse and they are coming under respective master field.

Using spath command in the query I am able to get the exact data but how to implement the same in the back end file to avoid using this command at search time.

Thanks,
Sam

Tags (1)
0 Karma
1 Solution

Explorer

You can try the following in props.conf

[sourcteype]
INDEXED_EXTRACTIONS = json
KV_MODE = none

View solution in original post

Ultra Champion

We had the following thread about this subject at - What are the requirements for a perfect Splunk JSON document?

The following worked for us -

INDEXED_EXTRACTIONS = json
category = Structured
0 Karma

Path Finder

Yes, you are absolutely right we can use this to parse and index the JSON data.

0 Karma

Communicator

I think if you have the data in splunk as sourcetype _json or json_no_timestamp you should be ok, see how this turns up in a verbose mode search and there may not be a need to use INDEXED_EXTRACTIONS=json or KV_MODE = none or spath queries.

There are issues when you have data that "contains" JSON, e.g. an exception message etc... That's when problems begin, is this the case.

0 Karma

Explorer

You can try the following in props.conf

[sourcteype]
INDEXED_EXTRACTIONS = json
KV_MODE = none

View solution in original post

Path Finder

I tried it but still getting the same result.

0 Karma

Champion

Did you try putting KV_MODE=_json OR INDEXED_EXTRACTION = _json?

0 Karma

Path Finder

Yes, already tried KV_MODE=JSON but no luck 😞

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!