Getting Data In

Apply spath automatically to a sourcetype with nested JSON

Path Finder

Hi all, I have JSON events with complex properties, aka nested JSON objects. I know how to apply spath and create macro. But I want to apply the macro automatically to the sourcetype. Something similar to automatic lookup. How do I do this? Thanks,

EDIT:
I already have INDEXED_EXTRACTIONS. I can search first-level fields just fine. But some of these fields are of type JSON object. Example:

    {
      "field1": "stringValue",
      "field2": [
         {
             "field2_field1": 20
         }
      ]
     }

How do I search field2_field1 value without doing spath?

0 Karma

Esteemed Legend

The other way is to props.conf on your search head(s) with:

[YourSourcetypeHere]
KV_MODE = json
0 Karma

Contributor

Hi,
Please find the accepted answers in below link on splunk answers, this might help you:
https://answers.splunk.com/answers/202023/is-it-possible-to-create-a-macro-to-do-this.html

0 Karma

Path Finder

Hi, I don't think it does. Please see my edit

0 Karma

SplunkTrust
SplunkTrust

Hi,

Question title and descriptions bit misleading, please find below comment based on Question title Apply spath automatically to a sourcetype with nested JSON

If you only want to apply spath to extract all fields from Nested JSON then I'll suggest to ingest data with JSON extractions.

If you are forwarding data from Universal Forwarder then use below configurations on UF.

props.conf

[yoursourcetype]
INDEXED_EXTRACTIONS = JSON

Path Finder

No, it is exactly what I want. I already have INDEXED_EXTRACTIONS. I can search first-level fields just fine. But some of these fields are of type JSON object. Example:

    {
      "field1": "stringValue",
      "field2": [
         {
             "field2_field1": 20
         }
      ]
     }

How do I search field2_field1 without doing spath?

0 Karma

SplunkTrust
SplunkTrust

I have ingested above sample data in my lab environment with INDEXED_EXTRACTIONS = JSON and it extracted nested JSON as well with field name field2{}.field2_field1

To access this field easily for further usage in stats or any other command it will be good to rename it like | rename field2{}.* as * and after that you will able to see field called field2_field1 in Interesting fields.

Path Finder

Thanks! This works for me

0 Karma