Getting Data In

How to display JSON map as a single multi-value field instead of multiple auto-discovered fields?

sbarinov
Path Finder

Hello,

I have an input module that injects data as _json source type.
In each event I have a field named "parameters" that contains a map (key-value entries) like this:

"parameters": {
   "parameter-a": "1",
   "parameter-b": "2",
   ...
}

I don't know the map keys, they may correlate between events but are not consistent.
Splunk automatically extracts them as "parameters.parameter-a" and "parameters.parameter-b" fields and this is not what I want.
It would rather have a multi-value field named "parameters" with each line containing both key and value like:

parameter-a=1
parameter-b=2

When I use:

| spath output=parameters path=parameters

I get a field that contains a raw JSON value of the "parameters" field (with brackets, quotes and commas).
When I use:

| spath output=parameters path=parameters{}

I get empty field values.
Is there a way to do what I want?

Thank you.

1 Solution

poete
Builder

Hello @sbarinov,

please try this:

| makeresults 
| eval js="{\"parameters\": {\"parameter-a\": \"1\",\"parameter-b\": \"2\"}}"
| spath input=js path=parameters output=someOtherField
| spath input=someOtherField
| foreach parameter* [eval parameters=mvappend(parameters, '<<FIELD>>')]

View solution in original post

poete
Builder

Hello @sbarinov,

please try this:

| makeresults 
| eval js="{\"parameters\": {\"parameter-a\": \"1\",\"parameter-b\": \"2\"}}"
| spath input=js path=parameters output=someOtherField
| spath input=someOtherField
| foreach parameter* [eval parameters=mvappend(parameters, '<<FIELD>>')]

esalesap
Path Finder

How would you write the foreach statement if the parameters didn't share a name prefix like this: ?

| eval js="{\"parameters\": {\"wookie\": \"1\",\"jabba\": \"2\"}}" 

 

0 Karma

sbarinov
Path Finder

Thank you.

0 Karma

poete
Builder

Welcome ! Any time.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...