Getting Data In

How do I rename unknown field name in a JSON file?

sebastianstruwe
Explorer

Hi Splunker,

I want to rename an unknown field name from a JSON file. Please find the minimal example below:

{"timestamp": "2018-10-24T08:46:02.205664", 
"type": "sw", 
"serial": {"Switchah3nv": "000123456789"}, 
"system_time": "Wed Oct 24 08:46:04 CEST 2018", 
.....
}

{"timestamp": "2018-10-24T08:47:02.205664", 
"type": "fw", 
"serial": {"Switchcklaie7": "000987654321"}, 
"system_time": "Wed Oct 24 08:47:04 CEST 2018", 
.....
}

I'm trying to make a table for all the serial numbers. So something like:

hostname      | serial_number
Switchah3nv  |000123456789
Switchcklaie7 |000987654321

I'm able to rename one serial by using | rename serial.Switchah3nv AS serial_number , but I need something like | rename serial.{} AS serial_number or | rename serial.hostname AS serial_number

So anyone got an idea?

Best regards,

Sebastian

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @sebastianstruwe

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Something like the following should work for you (this is a run-anywhere search that you can copy/paste into your Splunk search bar and it will run):

| makeresults
| eval data="{\"timestamp\": \"2018-10-24T08:46:02.205664\", 
 \"type\": \"sw\", 
 \"serial\": {\"Switchah3nv\": \"000123456789\"}, 
 \"system_time\": \"Wed Oct 24 08:46:04 CEST 2018\",}"
| rex field=data "\"serial\": \{\"(?<hostname>[^\"]*)\": \"(?<serial_number>[^\"]*)\""
| table hostname, serial_number

The rex line is probably the only line (with the exception of the table line) that you really need to worry about, but it shows what you can do with the search to get the data that you want. The field=data part of the rex line will probably have to be changed to match your data.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...