Splunk Search

how to extract nested fields using search command

disha
Contributor

Hi,
I have a data like this. I need to extract HDID and VNM fields. Any help.

{[-]
BVER : "10.47b",
CHIP : "Bcm7425B1",
EID : 1,
FID : "45",
FVER : "STABLE-KA12.13.05.86-25350.271980",
HCNT : 1,
HDD : [
{[-]
HDID : "W1G016R6",
HID : "W1G016R6",
HMN : "ST1000VM002-9ZL162",
HSZ : "1000.2",
HTYP : 0,
HVC : 2,
VOL : [
{[-]
VNM : "gpfs",
VSZ : 3288
},
{[-]
VNM : "storage",
VSZ : 996916
}
]
}
],
IBTCNT : 6,
MID : "36866",
MT : 1477404,
PID : "832",
SID : "000-00426-37896-246",
TS : "Wed Dec 31 18:00:00 1969"
}

Right now I am able to extract first level of nesting like BVER,CHIP etc. For that My search command is:(just the simple syntax)
sourcetype="agent" | spath path="BVER" output=Bversion |fields Bversion

for spath path="HDD" it is giving the value [{"HDID":"W1G016R6","HID":"W1G016R6","HSZ":1000.2,"HMN":"ST1000VM002-9ZL162","HTYP":0,"HVC":2,"VOL":[{"VNM":"gpfs","VSZ":3288},{"VNM":"storage","VSZ":996916}]}]

Thanks

Tags (1)
0 Karma

stefandagerman
Path Finder

http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Spath#Examples

Have you tried spath path=HDD.HDID and it didn't work?

It should. and spath path=HDD.VOL.VNM should give you the third level element.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...