Feedback
Got feedback? We want it! Submit your comments and suggestions for our community here.

extracting nested json

MichaelBs
Loves-to-Learn Everything

MichaelBs_1-1715008039869.pngMichaelBs_2-1715008356513.png



I am trying to extract the path as a field to do a lookup with it. I've tried but it doesn't work. I need help extracting that path. There are other paths in the data but need that particular path

0 Karma

marnall
Motivator

Is your data being interpreted by Splunk as JSON? Try expanding the event fields and seeing if it automatically extracts the json fields. If not, you'll have to change the indexing of the event so it is read as a JSON object. Then you can use SPATH or the auto-extracted fields to get the desired values.

0 Karma

MichaelBs
Loves-to-Learn Everything

Spath didn't give the right fields 

0 Karma

youngsuh
Contributor

you have to search and index the json by branch and nodes.  If you need the SPL, let me know.

0 Karma

MichaelBs
Loves-to-Learn Everything

I need the SPL

0 Karma

MichaelBs
Loves-to-Learn Everything
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...