How to fetch keywords from row logs

[aditsss]

Hi Team,

I have below row logs:

CarsDeltaHierarchyProcessor - CARS_HIERARCHY event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

I want to create one table like this

phrase                                                                                        status                     description

 CARS_HIERARCHY event published to ebnc                SUCCESS              "Event saved to database successfully.

can someone help me with query.

My current query:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "CarsDeltaHierarchyProcessor - CARS_HIERARCHY event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]"

[gcusello · Accepted solution]

Hi @aditsss,

this seems yo be a json format, did you tried to use the "INDEXED_EXTRACTIONS = json" in the props.conf aor the spath command in your search?

check if after this command you have all the fields you need:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "CarsDeltaHierarchyProcessor - CARS_HIERARCHY event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]"
| spath
| table something.phrase something.status something.description

Surely the fields to use in the following table command will have some prefixes that I cannot know, but that you can find in the interesting fields.

Ciao.

Giuseppe

[gcusello]

Hi @aditsss,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉