How to extract fields without a name from a JSON event?

[dannili]

Hi all, I'm using virtual index to access log files stored in Hadoop and then trying to extract certain values from JSON formatted file. But the the parsed file does not have name but only string values enclosed in ""with comma between them so the rex wouldn't work. So I was wondering if there's any possible solution to extract these. here's one example:(For example I'm extracting two email address)

11:14:45.000 AM "admin0f.online.lync.com","073e10cd-3910-46d9-95ee-e72ff0ed41dc","False","f24484cef680422ca872a99e47986e5d;add34fecd1;44a0bc0b3e","","7/13/2018 9:34:52 AM","7/13/2018 9:36:44 AM","[email protected]","[email protected]","UCCAPI/16.0.9330.2118 OC/16.0.9330.2118 (Skype for Business)","UCCAPI/16.0.9330.2118 OC/16.0.9330.2118 (Skype for Business)","","","34872F8C-DBB6-53AD-8815-9328990D7FB8","B4DD4A65-1BFA-5E22-9194-F8D06EA27D9F","","","","","200","[IM]","{""RequestType"":""BYE"",""RequestTime"":""2018-07-13T09:36:44.016"",""ContentType"":""application/sdp;call-type=im"",""ResponseCode"":"""",""DiagnosticId"":51004,""ErrorCategory"":""Success"",""DiagnosticHeader"":""51004; reason=\""Action initiated by user\"";\""OriginalPresenceState=\""\""3000\""\"";CurrentPresenceState=\""\""3000\""\"";MeInsideUser=\""\""No\""\"";ConversationInitiatedBy=\""\""6\""\"";SourceNetwork=\""\""2\""\"";RemotePartyCanDoIM=\""\""Yes\""\""\""""} {""RequestType"":""BYE"",""RequestTime"":""2018-07-13T09:36:43.5572341"",""ContentType"":"""",""ResponseCode"":""200"",""DiagnosticId"":51004,""ErrorCategory"":""Success"",""DiagnosticHeader"":""51004; reason=\""Action initiated by user\""""}

[acharlieh · Accepted solution]

That event is not JSON ... it's a CSV, where one field happens to be JSON encoded within it. You should look into defining a sourcetype, that defines extractions based on delimiters.

You can use the field extractor to help you with this definition:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/FXSelectMethodstep
http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/FXRenameFieldsstep

Alternatively you could use regular expressions to skip through a certain number of groups of (Not comma, comma) until you come to your email addresses that you want to extract, but that seems more tedious.

[dannili]

btw there's a typo in question... I meant exactly the regular expression, that is, rex.

[dannili]

Yes you are right.. I totally misinterpreted it. Thanks a lot!