Can you help us parse the following JSON ?

[saranya12]

i have tried the spath command, but no results. I would like to display the below data into a table as shown below:

10:40:19.682 INFO  com.sample.splunk.service.splunkService - Splunk_SampleJson —>{“fileNamesList:[{“fileName”:”fileName1.zip"},{"fileName":"fileName2.zip”},{“fileName":"fileName3.zip”}]} I wanted to get data in table format 

FileName
——————
fileName1
fileName2
FileName3

[woodcock]

Like this:

| makeresults 
|  eval _raw="10:40:19.682 INFO com.sample.splunk.service.splunkService - Splunk_SampleJson —>{\"fileNamesList:[{\"fileName\":\"fileName1.zip\"},{\"fileName\":\"fileName2.zip\"},{\"fileName\":\"fileName3.zip\"}]}"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex max_match=0 "\"fileName\":\"(?<fileName>[^\"]+)"
| table fileName
| mvexpand fileName

You may not need the last line (try with and without).

[somesoni2 · Accepted solution]

Thats probably because spath works on pure json data and your long entry is not pure json (it has those timestamps and other info before the json portion). You can extract the json portion into a new field and use spath on that, e.g.

your base search | rex "^([^\{]+)(?<jsondata>.+)$" | spath input=jsondata

[saranya12]

Thank you worked for me , adding complete search query it might help some one

my base search | rex "^([^\{]+)(?<jsondata>.+)$" |spath input=jsondata output=fileName path=fileNamesList{}.fileName |table fileName

[somesoni2]

Thanks for sharing your working search. Please remember to format your searches/code snippet by selecting the query and clicking on "101010" button on the top of the text area.

Please mark this question answered by accepting this as an answer.