Getting Data In

Extract fields from json and nested json

gemrose
Explorer

I am using regex to extract the field from the below json data. I want to extract the fields in key-value pair specially log.message from the json data. Example if I need "action" field from log.message

clusterName: cluster-9gokdwng4f
internal_tag: internal_security
log: { [-]
message: {"action":"EXECUTE","class":"System-Queue","eventC":"Data access event","eventT":"Obj-Open with role","timeStamp":"Wed 2024 Apr 03, 04:58:28:932"}
stack:
thread_name: Batch-1
timestamp: 2024-04-03T04:58:28.932Z
version: 1
}
}
Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Don't use simple regexes to manipulate structured data. Earlier or later you'll regret it (you'll get yourself in a situation with some (un)escaped delimiter or similar thing).

2. This is not a well-formed json.

3. Splunk doesn't handle well json (or any other structured data like XML) with additional content "surrounding" it in terms of automatic extraction so your best bet would be to extract the json part (with caution - see point 1) and run spath command on that field. Unfortunately it cannot be made as automatic extraction. It needs to be invoked manually in your search pipeline.

0 Karma

gemrose
Explorer

I used spath for extraction

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...