Getting Data In

How to achieve json event key=value to table as event not column name?

jbanAtSplunk
Communicator

Hi,

i have event like
vuln {

    host: some_host
    cve: {

        base_score: 10
        description: "Really nasty"
        references: [link_1

                                link_2]

    }
   remediation: {

     something: "something"

   }
}


Now I don't want table where json key is Column name but as Event raw in Table .

I would like to have dynamic Table something like

Name               | Value
base_score   | 10
description   |  Really nasty
references    | link_1, link_2

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You mean like this

| makeresults
| eval _raw="{ \"vuln\" : {
    \"host\": \"some_host\",
    \"cve\": {
        \"base_score\": 10,
        \"description\": \"Really nasty\",
        \"references\": [\"link_1\",
        \"link_2\"]
    },
   \"remediation\": {
     \"something\": \"something\"
   }
}
}"
| spath 
| fields - _raw _time
| fields vuln.cve.*
| rename vuln.cve.* as *
| transpose 0 column_name="Key"
| rename "row 1" as Value

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Take a look at Brett Adams' app on Splunkbase

https://splunkbase.splunk.com/app/6161/

that is designed to extract key/value pairs as fields.

 

0 Karma

jbanAtSplunk
Communicator

It didn't solve my challenge.

Basically what I am doing is a Visualization, when you click on CVE then I am population token and I want to create Table with CVE information but not as:

Column_1_name, Column_2_name,Column_3_name, .... as it's really not readable.

But I wanna have Table
Column_1_key, Column_2_value
key_name_1, key_value_1
key_name_2, key_value_2

I am really confused that Splunk does not have something like that out-of-the-box.

Or at least, can I somehow create a search, retrieve event and than manually fix column names and "event row's"

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You mean like this

| makeresults
| eval _raw="{ \"vuln\" : {
    \"host\": \"some_host\",
    \"cve\": {
        \"base_score\": 10,
        \"description\": \"Really nasty\",
        \"references\": [\"link_1\",
        \"link_2\"]
    },
   \"remediation\": {
     \"something\": \"something\"
   }
}
}"
| spath 
| fields - _raw _time
| fields vuln.cve.*
| rename vuln.cve.* as *
| transpose 0 column_name="Key"
| rename "row 1" as Value
0 Karma

jbanAtSplunk
Communicator

Yes, Thank you 🙂
I modified it a bit to map original json event and it's working as charm 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...