Getting Data In

How do I get Splunk to recognize and parse one of my field values in JSON format?

brent_weaver
Builder

I have perfect key/value pairs in my log (I am using the Splunk Add-on for Microsoft Azure to get table storage logs). The logs have:

LogTyppe:    LogTyppe   
MessageDetail:   {"test"="this will work", "name"="value", "name1"="value1", "name2"="value2"}
MessageSummary:  MessageSummary 
NetworkAddress:  NetworkAddress 

Notice in MessageDetail there is a JSON formatted string... How do I get Splunk to recognize that one of the field values as json format?

0 Karma

Masa
Splunk Employee
Splunk Employee

Hi, @ brent_weaver, please update the title and question and avoid saying the event is json. Otherwise, people misunderstand this question itself.

0 Karma

Masa
Splunk Employee
Splunk Employee
 {"test"="this will work", "name"="value", "name1"="value1", "name2"="value2"}

This is not json format???

Assuming you have json format value for MessageDetail field,

 <your search> | spath input=MessageDetail
0 Karma

gjanders
SplunkTrust
SplunkTrust

http://json.org/example.html is an example of what JSON data actually looks like, the above is key=value which is not JSON...

0 Karma

jkat54
SplunkTrust
SplunkTrust

using spath in verbose mode?

0 Karma

brent_weaver
Builder

THANK YOU for the answer. Let me ask a little bit differently, how do I get this field to be treated as interesting fields?

0 Karma

Masa
Splunk Employee
Splunk Employee

Sorry but I do not understand your question.
Also, instead of creating a new answer, can you add comment to an existing answer or, update your question as more elaborated question?

0 Karma

Masa
Splunk Employee
Splunk Employee

I'm still trying to understand your question especially your word "this field" above. Maybe it is because I do not understand Azure event contents.

Assuming you want to have Key-Value field extraction for any format of "key"="value" string, you can achieve it in transforms.conf and props.conf.
Note: I'm assuming sourcetype is azure_test in this example.

- props.conf
[azure_test]
REPORT-extract_kv = extact_kv

- transforms.conf
[extract_kv]
REGEX = "(?<_KEY_1>[^\"]+)"="(?<_VAL_1>[^\"]+)"

Of course using this idea, you can do more specific for only for certain field value, etc.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...