Getting Data In

How to parse JSON in Splunk?

SuganyaSSF
Explorer

Hi ,

I am using the Splunk REST API to call a rest service and i need to parse the data to Splunk.

We are getting the response like this

[{"port":"port1" , "version" :"1.o"},{"port":"port1" , "version" :"1.o"}]

However when i index this data to a JSON source type, i am not able to see the data in JSON format clearly and getting an response like this

[ [-] 
   { [+] 
   } 
   { [+] 
   } 
]

But if save the response to a JSON file and add that as input, we are able to get the data in correct format in Splunk.
Do we have a way to fix this?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Do you see your data when you expand the objects by clicking the plus icon?

0 Karma

chuckers
Path Finder

Try a variant of this.

| rex "(?<json_blob>{.*})" | spath input=json_blob

You might need to tweak it a little to deal with the square brackets, but the idea is that the rex function isolates the json and then the spath parses out all the values.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...