Getting Data In

Extract fields from json and nested json

gemrose
Explorer

I am using regex to extract the field from the below json data. I want to extract the fields in key-value pair specially log.message from the json data. Example if I need "action" field from log.message

clusterName: cluster-9gokdwng4f
internal_tag: internal_security
log: { [-]
message: {"action":"EXECUTE","class":"System-Queue","eventC":"Data access event","eventT":"Obj-Open with role","timeStamp":"Wed 2024 Apr 03, 04:58:28:932"}
stack:
thread_name: Batch-1
timestamp: 2024-04-03T04:58:28.932Z
version: 1
}
}
Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Don't use simple regexes to manipulate structured data. Earlier or later you'll regret it (you'll get yourself in a situation with some (un)escaped delimiter or similar thing).

2. This is not a well-formed json.

3. Splunk doesn't handle well json (or any other structured data like XML) with additional content "surrounding" it in terms of automatic extraction so your best bet would be to extract the json part (with caution - see point 1) and run spath command on that field. Unfortunately it cannot be made as automatic extraction. It needs to be invoked manually in your search pipeline.

0 Karma

gemrose
Explorer

I used spath for extraction

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...