Getting Data In

How can I search specific object value of json data in spunk?

New Member

How can I search for results where value of C is 987654321 and E is null from the below sample.

CLASS=Test MTD=getMethod LN=10 : METRICS_JSON_NODE=
"ABC": [
{
"A": "abc",
"B": "c1b1a1",
"C": 987654321,
"D": 123,
"E": 123456789,
"F": false,
"G": "bcfaff1d50025094089f5a02d0dbd00e568d7dbe"
}
]
}

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

@chaithanyaSplunk, try the following run anywhere search based on sample data provided. You need to put in your base search instead of first two pipes i.e. | makeresults and | eval _raw ..., which are used to generate mock data.

Your JSON Data needs to be extracted from _raw, which I have done using rex command and extracted jsonData. The jsonData is fed to spath command as input to extract all the fields. Finally where command is used to implement the filter you need.

|  makeresults
|  eval _raw="CLASS=Test MTD=getMethod LN=10 : METRICS_JSON_NODE=
\"ABC\": [
{
\"A\": \"abc\",
\"B\": \"c1b1a1\",
\"C\": 987654321,
\"D\": 123,
\"E\": 123456789,
\"F\": false,
\"G\": \"bcfaff1d50025094089f5a02d0dbd00e568d7dbe\"
}
]
}"
|  rex "(?ms)\"ABC\": \[(?<jsonData>[^\]]+\])"
|  spath input=jsonData
|  where C=987654321 AND isnotnull(E)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

SplunkTrust
SplunkTrust

You can also try search command instead of final where pipe

 <YourBaseSearch>
|  rex "(?ms)\"ABC\": \[(?<jsonData>[^\]]+\])"
|  spath input=jsonData
| search C=987654321 AND E=*
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

@chaithanyaSplunk, can you please confirm whether this resolved your issue or not?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma