Getting Data In

How to parse JSON with JSON array to identify fields?

ziyod2005
Explorer

Could someone guide me through to parse JSON within JSON array? I have tried many different variations with spath command but without luck

source = connection.txt

begin: {
"conn":
{
"type":"scp",
"ip":"1.1.1.1",
"userName":"tiger",
"password":"wood",
"platform":"ibm",
"retryCnt":10
},
"mainCommandsList":
[{
"commandSetId":"1234",
"commandSetName":"setName",
"commandListType":"listType",
"commandList":
[
{
"commandLineId":1,
"commandLevel":0,
"command":"sh redundancy inter-device",
"lineFeedCnt":1,
"ignoreErrors":true
}
]
}
],
"serialNumber":"aaaaaaaa1",
"scpHostName":"10.10.10.10",
"scpUserName":"testUser",
"scpPassword":"testPass",
"scpRoot":"downloads"
}

Tags (3)
0 Karma

somesoni2
Revered Legend

It seems that your events don't have true json format (due to 'begin: ' in the start. In case you can't get rid of that, you can try this workaround:

your base search | rex "begin:\s*(?<temp_raw>.*)"| spath input=temp_raw... rest your your search

psidler
Explorer

Hi,

I also had some problems getting the JSON Data into splunk. I have tried the following:

Setting Sourcetype to _json

Added the following to the props.conf:

[_json]
KV_MODE = _json
LINE_BREAKER = "(^){"
SHOULD_LINEMERGE = false
MAX_EVENTS = 3000000
TRUNCATE = 3000000

I used MAX_EVENTS and TRUNCATE because my JSON Events has more ore less 10000 lines.

For xour JSON sample i would use:

[_json]
KV_MODE = _json
LINE_BREAKER = "(^)begin: {"
SHOULD_LINEMERGE = false

Then it should build the events for you:

conn.type = scp
conn.ip = 1.1.1.1
conn.userName = tiger
conn.password =wood
...
...
conn.mainCommandsList.commandSetId = 1234
conn.mainCommandsList.commandSetName = setName
...
...

I hope this is what you are looking for.

Regards,
Patrik

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...