Getting Data In

How to extract Fields custom JSON File in Splunk

ashish9433
Communicator

I have custom JSON File on Splunk but SPATH command is not able to extract the fields from the data. Can any one suggest me what would be the best way to extract fields from the below JSON Data

{"log":"| loglevel=\"INFO\" | hostname=\"import-1-4-3-2053088235-873gq\" | transactionId=\"a0991eed-46bd-49df-9545-87deae988b6c\" | serviceName=\"import\" | version=\"1.4.3\" | thread=\"https-jsse-nio-8443-exec-12\" | logger=\"c.a.e.s.l.d.s.impl.ScheduleServiceImpl \" | message=\"Get Schedule BOC\" | status=\"GET_SCHEDULE_BOC\" | code=\"00139\" | uri=\"https://layer-1-0-2.schedule-schedule/scheduleLayer/search?version=1\u0026envContext=PROD\u0026routeOffer=BLUE\" | request=\"{\"details.type\":\"signalpath\",\"details.boc\":\"0306\"}\" \n","stream":"stdout","time":"2017-05-13T16:50:41.377682354Z"}

In Splunk the data appears formatted in JSON, but not all the fields appear as JSON formatted and thus i feel SPATH command is not working. I am able to extract the above content in a field named as Log, but the internal fields which are separated by "|". The below is the screenshot how the data appears in Splunk. Can anyone help me in extracting the fields automatically?

alt text

0 Karma
1 Solution

koshyk
Super Champion

So on your already extracted spath (the screenshot output)

.. | rex field=log "(\w+)=([^\s]+)"

This will split the rest of fields present within log to key-value pairs
Example in regex101: https://regex101.com/r/4Y0aJG/1

View solution in original post

koshyk
Super Champion

So on your already extracted spath (the screenshot output)

.. | rex field=log "(\w+)=([^\s]+)"

This will split the rest of fields present within log to key-value pairs
Example in regex101: https://regex101.com/r/4Y0aJG/1

Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...