Getting Data In

How to parse JSON in Splunk?

SuganyaSSF
Explorer

Hi ,

I am using the Splunk REST API to call a rest service and i need to parse the data to Splunk.

We are getting the response like this

[{"port":"port1" , "version" :"1.o"},{"port":"port1" , "version" :"1.o"}]

However when i index this data to a JSON source type, i am not able to see the data in JSON format clearly and getting an response like this

[ [-] 
   { [+] 
   } 
   { [+] 
   } 
]

But if save the response to a JSON file and add that as input, we are able to get the data in correct format in Splunk.
Do we have a way to fix this?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Do you see your data when you expand the objects by clicking the plus icon?

0 Karma

chuckers
Path Finder

Try a variant of this.

| rex "(?<json_blob>{.*})" | spath input=json_blob

You might need to tweak it a little to deal with the square brackets, but the idea is that the rex function isolates the json and then the spath parses out all the values.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...