How do I rename unknown field name in a JSON file?

[sebastianstruwe]

Hi Splunker,

I want to rename an unknown field name from a JSON file. Please find the minimal example below:

{"timestamp": "2018-10-24T08:46:02.205664", 
"type": "sw", 
"serial": {"Switchah3nv": "000123456789"}, 
"system_time": "Wed Oct 24 08:46:04 CEST 2018", 
.....
}

{"timestamp": "2018-10-24T08:47:02.205664", 
"type": "fw", 
"serial": {"Switchcklaie7": "000987654321"}, 
"system_time": "Wed Oct 24 08:47:04 CEST 2018", 
.....
}

I'm trying to make a table for all the serial numbers. So something like:

hostname      | serial_number
Switchah3nv  |000123456789
Switchcklaie7 |000987654321

I'm able to rename one serial by using | rename serial.Switchah3nv AS serial_number , but I need something like | rename serial.{} AS serial_number or | rename serial.hostname AS serial_number

So anyone got an idea?

Best regards,

Sebastian

[mstjohn_splunk]

Hi @sebastianstruwe

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[cpetterborg]

Something like the following should work for you (this is a run-anywhere search that you can copy/paste into your Splunk search bar and it will run):

| makeresults
| eval data="{\"timestamp\": \"2018-10-24T08:46:02.205664\", 
 \"type\": \"sw\", 
 \"serial\": {\"Switchah3nv\": \"000123456789\"}, 
 \"system_time\": \"Wed Oct 24 08:46:04 CEST 2018\",}"
| rex field=data "\"serial\": \{\"(?<hostname>[^\"]*)\": \"(?<serial_number>[^\"]*)\""
| table hostname, serial_number

The rex line is probably the only line (with the exception of the table line) that you really need to worry about, but it shows what you can do with the search to get the data that you want. The field=data part of the rex line will probably have to be changed to match your data.