Getting Data In

How to extract Fields custom JSON File in Splunk

ashish9433
Communicator

I have custom JSON File on Splunk but SPATH command is not able to extract the fields from the data. Can any one suggest me what would be the best way to extract fields from the below JSON Data

{"log":"| loglevel=\"INFO\" | hostname=\"import-1-4-3-2053088235-873gq\" | transactionId=\"a0991eed-46bd-49df-9545-87deae988b6c\" | serviceName=\"import\" | version=\"1.4.3\" | thread=\"https-jsse-nio-8443-exec-12\" | logger=\"c.a.e.s.l.d.s.impl.ScheduleServiceImpl \" | message=\"Get Schedule BOC\" | status=\"GET_SCHEDULE_BOC\" | code=\"00139\" | uri=\"https://layer-1-0-2.schedule-schedule/scheduleLayer/search?version=1\u0026envContext=PROD\u0026routeOffer=BLUE\" | request=\"{\"details.type\":\"signalpath\",\"details.boc\":\"0306\"}\" \n","stream":"stdout","time":"2017-05-13T16:50:41.377682354Z"}

In Splunk the data appears formatted in JSON, but not all the fields appear as JSON formatted and thus i feel SPATH command is not working. I am able to extract the above content in a field named as Log, but the internal fields which are separated by "|". The below is the screenshot how the data appears in Splunk. Can anyone help me in extracting the fields automatically?

alt text

0 Karma
1 Solution

koshyk
Super Champion

So on your already extracted spath (the screenshot output)

.. | rex field=log "(\w+)=([^\s]+)"

This will split the rest of fields present within log to key-value pairs
Example in regex101: https://regex101.com/r/4Y0aJG/1

View solution in original post

koshyk
Super Champion

So on your already extracted spath (the screenshot output)

.. | rex field=log "(\w+)=([^\s]+)"

This will split the rest of fields present within log to key-value pairs
Example in regex101: https://regex101.com/r/4Y0aJG/1

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...