Getting Data In

How do I strip the namespace of JSON fields?

Ultra Champion

Based on How to assign a field alias to a json field?

We ended up with large blocks as -

FIELDALIAS-alias0 = "apiRequest.reqInfo.clientID" AS clientID
FIELDALIAS-alias1 = "apiRequest.reqHeader.appContext" AS appContext
FIELDALIAS-alias2 = "apiRequest.reqHeader.dob" AS dob
FIELDALIAS-alias3 = "apiRequest.reqHeader.encryptedUserName" AS encryptedUserName
FIELDALIAS-alias4 = "apiRequest.reqHeader.firstName" AS firstName
FIELDALIAS-alias5 = "apiRequest.reqHeader.lastName" AS lastName
FIELDALIAS-alias6 = "apiRequest.reqHeader.memberId" AS memberId

Is there a way to strip the JSON namespace of the fields instead of aliasing each one of them as we do above?

0 Karma

Ultra Champion

Our sales engineer said -

Unfortunately, the FIELDALIAS stanza in props.conf cannot accept wildcards. You’d have to write a custom field extraction (though this is pretty trivial) and give-up the automatic field extractions Splunk performs on the JSON structure.

0 Karma

Revered Legend

Ultra Champion

Much appreciated @somesoni2 !!!

0 Karma



Can you please share some sample data?

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...