Dashboards & Visualizations

How to fetch value from nested JSON

rkishoreqa
Path Finder

Hi team, 

 

How can I get the value of 'status' from below payload in Splunk search.

{"log":" \"status\" : \"END\",","payload":"stdout","time":"2021-08-13T11:54:17.255787345Z"}

 

Thanks in Advance.

Labels (2)
0 Karma
1 Solution

williamchenyp
Explorer

Is this a one time use extraction, or do you need to do this extraction on a regular basis?    Also, is the JSON formatting always identical where it always begins with: 

{"log":" \"status\" : \"END\" 

 

If it's only a time time use, what if you treat the double-quotes as a delimiter of a multivalue string?   Then the SPL will be something like below to spit out   \"status\"  

| makeresults 
| eval aaa="{\"log\":\" \\\"status\\\" : \"END\",\",\"payload\":\"stdout\",\"time\":\"2021-08-13T11:54:17.255787345Z\"}" 
| eval aaa="\\\"".mvindex(split(aaa, "\""), 4)."\""

 

View solution in original post

williamchenyp
Explorer

Is this a one time use extraction, or do you need to do this extraction on a regular basis?    Also, is the JSON formatting always identical where it always begins with: 

{"log":" \"status\" : \"END\" 

 

If it's only a time time use, what if you treat the double-quotes as a delimiter of a multivalue string?   Then the SPL will be something like below to spit out   \"status\"  

| makeresults 
| eval aaa="{\"log\":\" \\\"status\\\" : \"END\",\",\"payload\":\"stdout\",\"time\":\"2021-08-13T11:54:17.255787345Z\"}" 
| eval aaa="\\\"".mvindex(split(aaa, "\""), 4)."\""

 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@rkishoreqa 

Can you please try this?

YOUR_SEARCH
| rex field=_raw "\\\\\"status\\\\\"\s\:\s\\\\\"(?<status>.*)\\\\\","
| stats count by status

 

My Sample Search :

| makeresults | eval _raw="{\"log\":\" \\\"status\\\" : \\\"END\\\",\",\"payload\":\"stdout\",\"time\":\"2021-08-13T11:54:17.255787345Z\"}"
| rex field=_raw "\\\\\"status\\\\\"\s\:\s\\\\\"(?<status>.*)\\\\\","
| stats count by status


 KV

Tags (1)

manjunathmeti
SplunkTrust
SplunkTrust

hi @rkishoreqa,

Use rex command.

| makeresults 
| eval f="{\"log\":\" \"status\" : \"END\",\",\"payload\":\"stdout\",\"time\":\"2021-08-13T11:54:17.255787345Z\"}" 
| rex field=f "\"status\"\s:\s\"(?<status>\w+)\""

 

If this reply helps you, a like would be appreciated.

 

0 Karma

rkishoreqa
Path Finder

@manjunathmeti 

I tried with below query, but it is not working. 

index="dev" |rex field=f "\"status\"\s:\s\"(?<status>\w+)\"" |stats count by status.

 

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Remove field=f in your query. For field, you need to specify the actual field name that exists in your index dev. Or don't specify if you are extracting values from _raw event.

Try without specifying field:

index="dev" | rex "\"status\"\s:\s\"(?<status>\w+)\"" | stats count by status

 If you have backslashes in your data then,

index="dev" | rex "\"status\\\\\"\s:\s\\\\\"(?<status>[^\\\]+)"

 

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!