Deployment Architecture

How to achieve renaming JSON field names?

dvuchev
Engager

Hey All,
wondering if I can get some input on this. I have data coming in as JSON. The fields follow this naming convention:

objects.Server::34385.fields.friendlyname = Server123
objects.Server::88634.fields.friendlyname = Server444

What I'm trying to do is to somehow rename the fields, so I omit the ::<number> after the Server part.
End result is needed to be like this:
objects.Server.fields.friendlyname = Server123
objects.Server.fields.friendlyname = Server444

It's worth mentioning that there are around 10k servers, so I can't list them out one by one.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| foreach *::*.*
    [| eval "<<MATCHSEG1>>.<<MATCHSEG3>>" = if(isnotnull('<<FIELD>>'),'<<FIELD>>','<<MATCHSEG1>>.<<MATCHSEG3>>')]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| foreach *::*.*
    [| eval "<<MATCHSEG1>>.<<MATCHSEG3>>" = if(isnotnull('<<FIELD>>'),'<<FIELD>>','<<MATCHSEG1>>.<<MATCHSEG3>>')]
0 Karma

dvuchev
Engager

@ITWhisperer Thanks so much, was able to get what I needed with the | foreach

Marking as solution and DM 

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...