Based on How to assign a field alias to a json field?
We ended up with large blocks as -
FIELDALIAS-alias0 = "apiRequest.reqInfo.clientID" AS clientID FIELDALIAS-alias1 = "apiRequest.reqHeader.appContext" AS appContext FIELDALIAS-alias2 = "apiRequest.reqHeader.dob" AS dob FIELDALIAS-alias3 = "apiRequest.reqHeader.encryptedUserName" AS encryptedUserName FIELDALIAS-alias4 = "apiRequest.reqHeader.firstName" AS firstName FIELDALIAS-alias5 = "apiRequest.reqHeader.lastName" AS lastName FIELDALIAS-alias6 = "apiRequest.reqHeader.memberId" AS memberId ....
Is there a way to strip the JSON namespace of the fields instead of aliasing each one of them as we do above?
Our sales engineer said -
Unfortunately, the FIELDALIAS stanza in
props.conf cannot accept wildcards. You’d have to write a custom field extraction (though this is pretty trivial) and give-up the automatic field extractions Splunk performs on the JSON structure.
Much appreciated @somesoni2 !!!
Can you please share some sample data?