Getting Data In

Extract value from json in props.conf

Path Finder

Hi All,

I want to extract email  from json event in splunk.

Query I am using is :



index=*sec sourcetype=test
| eval tags_json=spath(_raw, "Tag{}"), final_tag_json=json_object()
| foreach mode=multivalue tags_json [ | eval final_tag_json=json_set(final_tag_json, spath('<<ITEM>>', "Key"), spath('<<ITEM>>', "Value"))]
| spath input=final_tag_json
| rex field=Email "(?<email>^\$)"



Raw data :



"Tag": [{"Key": "app", "Value": “test”_value}, {"Key": "key1", "Value": "value1"}, {"Key": "key2", "Value": "value2"},  {"Key": “email”, "Value": “}],



I want email to be mapped to contact when indexed. How can I achieve this ? Please help me


0 Karma


Hi @Poojitha following the example from the documentation on spath 

Here is a runanywhere example:

| makeresults
| eval _raw="{
\"Tag\": [
    {\"Key\": \"app\", \"Value\": \"test_value\"}, 
    {\"Key\": \"key1\", \"Value\": \"value1\"}, 
    {\"Key\": \"key2\", \"Value\": \"value2\"},  
    {\"Key\": \"email\", \"Value\": \"\"},
| spath
| rename Tag{}.Key as key, Tag{}.Value as value
| eval x=mvzip(key,value)
| mvexpand x
| eval x=split(x,",")
| eval key=mvindex(x,0)
| eval value=mvindex(x,1)
| table _time key value


0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...