Getting Data In
Highlighted

Data search in JSON format

New Member

Good day. I did not find the answer to my question, so I made a new topic. My device sends data from IDS in JSON format. I get this data in Splunk. The data is presented below in the screenshot. I try to search on various data, but it doesn’t work. I see that the search is successful, but I don’t see the fields I need. In the "questions and answers" section, I found a recommendation to change the value of the "KV_MODE" field, but this did not help. Please tell me what I'm doing wrong. What I need to pay attention to.

The data has the following structure:

Apr 22 18:09:26 172.20.8.2 Apr 22 18:09:54 vpnfw dmutmd[1505]:
{

"source": "IDS",

"message":
{
"alert":
{
"action":"allowed",
"category":"A Network Trojan was detected",
"gid":1,
"metadata":
{

"affectedproduct":["WindowsXPVista7810Server3264Bit"],
"attacktarget":["ClientEndpoint"],
"createdat":["20150313"],
"deployment":["Perimeter"],
"former
category":["ADWAREPUP"],
"group
tss":["2"],
"malwarefamily":["Loadmoney"],
"performance
impact":["Low"],
"priority":["1"],
"signatureseverity":["Minor"],
"tag":["Loadmoney"],
"updated
at":["20191007"]
},
"rev":8,
"severity":1,
"signature":"ET MALWARE Loadmoney User Agent",
"signatureid":2024249
},
"app
proto":"http",
"destip":"5.9.80.173",
"dest
port":80,
"event_type":"alert"
}
}

I'm doing a search with the following query: "IDS | spath path=message.alert.category" and get a result.

alt text
alt text

0 Karma
Highlighted

Re: Data search in JSON format

Ultra Champion
0 Karma
Highlighted

Re: Data search in JSON format

SplunkTrust
SplunkTrust

The long term solution is to fix your ingestion and props so that JSONs are automatically extracted. In the meantime, you can use this code sample for finding your immediate solutions. A full run-anywhere example is after the break.

| rename COMMENT as "the below reformats that data so you can look at it."
| rex "^[\s\S]*?(?<myJSON>{[\s\S]*})"
| spath input=myJSON

Here's the full run-anywhere sample for anyone who wants to play with it.

|makeresults 
| rename COMMENT as "The above creates one dummy record, and the below inputs your sample data"
| eval _raw  = "Apr 22 18:09:26 172.20.8.2 Apr 22 18:09:54 vpnfw dmutmd[1505]:
{
\"source\": \"IDS\",
\"message\":
{
\"alert\":
{
\"action\":\"allowed\",
\"category\":\"A Network Trojan was detected\",
\"gid\":1,
\"metadata\":
{
\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],
\"attack_target\":[\"Client_Endpoint\"],
\"created_at\":[\"2015_03_13\"],
\"deployment\":[\"Perimeter\"],
\"former_category\":[\"ADWARE_PUP\"],
\"group_tss\":[\"2\"],
\"malware_family\":[\"Loadmoney\"],
\"performance_impact\":[\"Low\"],
\"priority\":[\"1\"],
\"signature_severity\":[\"Minor\"],
\"tag\":[\"Loadmoney\"],
\"updated_at\":[\"2019_10_07\"]
},
\"rev\":8,
\"severity\":1,
\"signature\":\"ET MALWARE Loadmoney User Agent\",
\"signature_id\":2024249
},
\"app_proto\":\"http\",
\"dest_ip\":\"5.9.80.173\",
\"dest_port\":80,
\"event_type\":\"alert\"
}
}"
| rename COMMENT as "The above just inputs your sample data"

| rename COMMENT as "the below reformats that data so you can look at it."
| rex "^[\s\S]*?(?<myJSON>{[\s\S]*})"
| spath input=myJSON
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.