How to extract unique Json String field value?

[srinim1234]

Hi,

I have the following JSON String logs. I would like to extract JSON unique field values. It should go over all the message fields and extract specific field values from a JSON array("name") and unique them. Could someone help with Splunk query?

Raw log

{
"@timestamp": "2022-03-28T07:38:45.123+00:00",
"message": "request - {\"metrics\":[{\"name\":\"m1\",\"downsample\":\"sum\"},{\"name\":\"m2\",\"downsample\":\"sum\"},{\"name\":\"m1\",\"downsample\":\"sum\"}]}"
}

JSON

 {
"metrics": [{
"name": "m1",
"aggregator": "sum",
}, {
"name": "m2",
"downsample": "sum"
}, {
"name": "m1",
"downsample": "sum"
}]
}

Expected Output:

m1
m2 
...

[kamlesh_vaghela · Accepted solution]

@srinim1234 

Can you please try below search?

YOUR_SEARCH
| rex field=message \"name\":\"(?<name>\w+)\" max_match=0
| mvexpand name
| table name

I suggest above search for your requirement. 

Below search for learning purpose as another way of achieving same output.

YOUR_SEARCH
| rex field=message "request - (?<data>.*)" | rename data as _raw | kv
|mvexpand metrics{}.name
| table metrics{}.name

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[srinim1234]

Thank you! This helped!

[ITWhisperer]

| rex max_match=0 "\\\\\"name\\\\\":\\\\\"(?<name>[^\\\\]+)"
| eval name=mvdedup(name)