Hi Splunker,
I want to rename an unknown field name from a JSON file. Please find the minimal example below:
{"timestamp": "2018-10-24T08:46:02.205664",
"type": "sw",
"serial": {"Switchah3nv": "000123456789"},
"system_time": "Wed Oct 24 08:46:04 CEST 2018",
.....
}
{"timestamp": "2018-10-24T08:47:02.205664",
"type": "fw",
"serial": {"Switchcklaie7": "000987654321"},
"system_time": "Wed Oct 24 08:47:04 CEST 2018",
.....
}
I'm trying to make a table for all the serial numbers. So something like:
hostname | serial_number
Switchah3nv |000123456789
Switchcklaie7 |000987654321
I'm able to rename one serial by using | rename serial.Switchah3nv AS serial_number
, but I need something like | rename serial.{} AS serial_number
or | rename serial.hostname AS serial_number
So anyone got an idea?
Best regards,
Sebastian
Hi @sebastianstruwe
Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!
Something like the following should work for you (this is a run-anywhere search that you can copy/paste into your Splunk search bar and it will run):
| makeresults
| eval data="{\"timestamp\": \"2018-10-24T08:46:02.205664\",
\"type\": \"sw\",
\"serial\": {\"Switchah3nv\": \"000123456789\"},
\"system_time\": \"Wed Oct 24 08:46:04 CEST 2018\",}"
| rex field=data "\"serial\": \{\"(?<hostname>[^\"]*)\": \"(?<serial_number>[^\"]*)\""
| table hostname, serial_number
The rex
line is probably the only line (with the exception of the table
line) that you really need to worry about, but it shows what you can do with the search to get the data that you want. The field=data
part of the rex
line will probably have to be changed to match your data.