Getting Data In
Highlighted

Can you help me get multiple fields from a single field in JSON?

Engager

The text field in my event contains A LOT of data.

json snipped :

{"Date":"2018-12-05T12:04:04.71","ID":"00000000-0000-0000-0000-000000000000","Text":"*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***} 

What i'm trying to do is write a search that will get all values of on/all fields.

i.e. "get all values of userCount"

i have had some progress using eval and split

eval values=split(Text," * ") |
eval temp=mvindex(values,0)|
eval temp=split(temp,"=")|eval temp=mvindex(temp,1)|convert rmunit(temp)|    
eval normalSliceUsage=temp| table Date normalSliceUsage
0 Karma
Highlighted

Re: Can you help me get multiple fields from a single field in JSON?

Motivator

Does one event in Splunk contain multiple lines of text or only one line?
When you search for your events in Splunk, is the field "userCount" available on the left side?

0 Karma
Highlighted

Re: Can you help me get multiple fields from a single field in JSON?

Builder

I guess Splunk should auto-extract field values when they are in foo=bar format, check your interesting fields for userCount, if not pls post a snippet of your json data.

0 Karma
Highlighted

Re: Can you help me get multiple fields from a single field in JSON?

Contributor

Hi,

Can you try the below search, the idea is to create those fields using rex.

index=<your index>
|  rex field=Text normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)

you can checkout the how the rex working in the below site,

https://regex101.com/

in the test string give the below,

*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***

in the regex give the below regex,

 normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)
0 Karma