Getting Data In

How do I remove extra information from field names when parsing JSON?

djain
Path Finder

Hi

I am trying to ingest JSON data from JSON files. However, instead of just taking the field name, it is also taking header and variable type. See screenshot. I want to remove device.headwaters.watermark.core from the beginning and .long or .string from the end. How can I do that? alt text

Tags (2)
0 Karma
1 Solution

niketn
Legend

@djain try the following:

<yourCurrentSearch>
| rename "device.headwaters.watermark.core.*" as "*"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @djain

were you able to try out the answer below? If it worked, would you mind approving it?

0 Karma

niketn
Legend

@djain try the following:

<yourCurrentSearch>
| rename "device.headwaters.watermark.core.*" as "*"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

djain
Path Finder

Thank you for the answer but I am looking for a more automated process to do this while the data is getting indexed by changing props file or settings at sourcetype

0 Karma

niketn
Legend

The reason why you are seeing additional name is because of the way your JSON is structured and default parsing will put all node names to make the traversed tree (field name) unique (unless it is a multi-valued field).

Option 1: You will have to get rid of either INDEXED_EXTRACTIONS = json OR KV_MODE=json (whichever is present) toKV_MODE=none without INDEXED_EXTRACTIONS and define your own field extraction. Refer to this answer by @somesoni2 https://answers.splunk.com/answers/484752/how-to-parse-json-which-makes-up-part-of-the-event.html

Option 2: Alternatively, if you are sure there are not events under any of the elements of the tree device.headwaters.watermark.core., you can create a transformation to index only the child JSON element with meaningful data i.e. everything inside code node. You should check out Splunk Answers for Routing and Filtering Data to index only specific part of JSON Payload data. Refer to @woodcock 's answer on similar lines: https://answers.splunk.com/answers/519236/split-indexing-from-json.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...