Getting Data In

How do I rename unknown field name in a JSON file?

Hi Splunker,

I want to rename an unknown field name from a JSON file. Please find the minimal example below:

{"timestamp": "2018-10-24T08:46:02.205664", 
"type": "sw", 
"serial": {"Switchah3nv": "000123456789"}, 
"system_time": "Wed Oct 24 08:46:04 CEST 2018", 

{"timestamp": "2018-10-24T08:47:02.205664", 
"type": "fw", 
"serial": {"Switchcklaie7": "000987654321"}, 
"system_time": "Wed Oct 24 08:47:04 CEST 2018", 

I'm trying to make a table for all the serial numbers. So something like:

hostname      | serial_number
Switchah3nv  |000123456789
Switchcklaie7 |000987654321

I'm able to rename one serial by using | rename serial.Switchah3nv AS serial_number , but I need something like | rename serial.{} AS serial_number or | rename serial.hostname AS serial_number

So anyone got an idea?

Best regards,


0 Karma

Splunk Employee
Splunk Employee

Hi @sebastianstruwe

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma


Something like the following should work for you (this is a run-anywhere search that you can copy/paste into your Splunk search bar and it will run):

| makeresults
| eval data="{\"timestamp\": \"2018-10-24T08:46:02.205664\", 
 \"type\": \"sw\", 
 \"serial\": {\"Switchah3nv\": \"000123456789\"}, 
 \"system_time\": \"Wed Oct 24 08:46:04 CEST 2018\",}"
| rex field=data "\"serial\": \{\"(?<hostname>[^\"]*)\": \"(?<serial_number>[^\"]*)\""
| table hostname, serial_number

The rex line is probably the only line (with the exception of the table line) that you really need to worry about, but it shows what you can do with the search to get the data that you want. The field=data part of the rex line will probably have to be changed to match your data.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!