Getting Data In

How to achieve json event key=value to table as event not column name?

jbanAtSplunk
Communicator

Hi,

i have event like
vuln {

    host: some_host
    cve: {

        base_score: 10
        description: "Really nasty"
        references: [link_1

                                link_2]

    }
   remediation: {

     something: "something"

   }
}


Now I don't want table where json key is Column name but as Event raw in Table .

I would like to have dynamic Table something like

Name               | Value
base_score   | 10
description   |  Really nasty
references    | link_1, link_2

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You mean like this

| makeresults
| eval _raw="{ \"vuln\" : {
    \"host\": \"some_host\",
    \"cve\": {
        \"base_score\": 10,
        \"description\": \"Really nasty\",
        \"references\": [\"link_1\",
        \"link_2\"]
    },
   \"remediation\": {
     \"something\": \"something\"
   }
}
}"
| spath 
| fields - _raw _time
| fields vuln.cve.*
| rename vuln.cve.* as *
| transpose 0 column_name="Key"
| rename "row 1" as Value

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Take a look at Brett Adams' app on Splunkbase

https://splunkbase.splunk.com/app/6161/

that is designed to extract key/value pairs as fields.

 

0 Karma

jbanAtSplunk
Communicator

It didn't solve my challenge.

Basically what I am doing is a Visualization, when you click on CVE then I am population token and I want to create Table with CVE information but not as:

Column_1_name, Column_2_name,Column_3_name, .... as it's really not readable.

But I wanna have Table
Column_1_key, Column_2_value
key_name_1, key_value_1
key_name_2, key_value_2

I am really confused that Splunk does not have something like that out-of-the-box.

Or at least, can I somehow create a search, retrieve event and than manually fix column names and "event row's"

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You mean like this

| makeresults
| eval _raw="{ \"vuln\" : {
    \"host\": \"some_host\",
    \"cve\": {
        \"base_score\": 10,
        \"description\": \"Really nasty\",
        \"references\": [\"link_1\",
        \"link_2\"]
    },
   \"remediation\": {
     \"something\": \"something\"
   }
}
}"
| spath 
| fields - _raw _time
| fields vuln.cve.*
| rename vuln.cve.* as *
| transpose 0 column_name="Key"
| rename "row 1" as Value
0 Karma

jbanAtSplunk
Communicator

Yes, Thank you 🙂
I modified it a bit to map original json event and it's working as charm 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...