Dashboards & Visualizations

How to fetch value from nested JSON

rkishoreqa
Communicator

Hi team, 

 

How can I get the value of 'status' from below payload in Splunk search.

{"log":" \"status\" : \"END\",","payload":"stdout","time":"2021-08-13T11:54:17.255787345Z"}

 

Thanks in Advance.

Labels (2)
0 Karma
1 Solution

williamchenyp
Explorer

Is this a one time use extraction, or do you need to do this extraction on a regular basis?    Also, is the JSON formatting always identical where it always begins with: 

{"log":" \"status\" : \"END\" 

 

If it's only a time time use, what if you treat the double-quotes as a delimiter of a multivalue string?   Then the SPL will be something like below to spit out   \"status\"  

| makeresults 
| eval aaa="{\"log\":\" \\\"status\\\" : \"END\",\",\"payload\":\"stdout\",\"time\":\"2021-08-13T11:54:17.255787345Z\"}" 
| eval aaa="\\\"".mvindex(split(aaa, "\""), 4)."\""

 

View solution in original post

williamchenyp
Explorer

Is this a one time use extraction, or do you need to do this extraction on a regular basis?    Also, is the JSON formatting always identical where it always begins with: 

{"log":" \"status\" : \"END\" 

 

If it's only a time time use, what if you treat the double-quotes as a delimiter of a multivalue string?   Then the SPL will be something like below to spit out   \"status\"  

| makeresults 
| eval aaa="{\"log\":\" \\\"status\\\" : \"END\",\",\"payload\":\"stdout\",\"time\":\"2021-08-13T11:54:17.255787345Z\"}" 
| eval aaa="\\\"".mvindex(split(aaa, "\""), 4)."\""

 

kamlesh_vaghela
SplunkTrust
SplunkTrust

@rkishoreqa 

Can you please try this?

YOUR_SEARCH
| rex field=_raw "\\\\\"status\\\\\"\s\:\s\\\\\"(?<status>.*)\\\\\","
| stats count by status

 

My Sample Search :

| makeresults | eval _raw="{\"log\":\" \\\"status\\\" : \\\"END\\\",\",\"payload\":\"stdout\",\"time\":\"2021-08-13T11:54:17.255787345Z\"}"
| rex field=_raw "\\\\\"status\\\\\"\s\:\s\\\\\"(?<status>.*)\\\\\","
| stats count by status


 KV

Tags (1)

manjunathmeti
Champion

hi @rkishoreqa,

Use rex command.

| makeresults 
| eval f="{\"log\":\" \"status\" : \"END\",\",\"payload\":\"stdout\",\"time\":\"2021-08-13T11:54:17.255787345Z\"}" 
| rex field=f "\"status\"\s:\s\"(?<status>\w+)\""

 

If this reply helps you, a like would be appreciated.

 

0 Karma

rkishoreqa
Communicator

@manjunathmeti 

I tried with below query, but it is not working. 

index="dev" |rex field=f "\"status\"\s:\s\"(?<status>\w+)\"" |stats count by status.

 

0 Karma

manjunathmeti
Champion

Remove field=f in your query. For field, you need to specify the actual field name that exists in your index dev. Or don't specify if you are extracting values from _raw event.

Try without specifying field:

index="dev" | rex "\"status\"\s:\s\"(?<status>\w+)\"" | stats count by status

 If you have backslashes in your data then,

index="dev" | rex "\"status\\\\\"\s:\s\\\\\"(?<status>[^\\\]+)"

 

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...