Getting Data In

How to parse JSON with JSON array to identify fields?

ziyod2005
Explorer

Could someone guide me through to parse JSON within JSON array? I have tried many different variations with spath command but without luck

source = connection.txt

begin: {
"conn":
{
"type":"scp",
"ip":"1.1.1.1",
"userName":"tiger",
"password":"wood",
"platform":"ibm",
"retryCnt":10
},
"mainCommandsList":
[{
"commandSetId":"1234",
"commandSetName":"setName",
"commandListType":"listType",
"commandList":
[
{
"commandLineId":1,
"commandLevel":0,
"command":"sh redundancy inter-device",
"lineFeedCnt":1,
"ignoreErrors":true
}
]
}
],
"serialNumber":"aaaaaaaa1",
"scpHostName":"10.10.10.10",
"scpUserName":"testUser",
"scpPassword":"testPass",
"scpRoot":"downloads"
}

Tags (3)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

It seems that your events don't have true json format (due to 'begin: ' in the start. In case you can't get rid of that, you can try this workaround:

your base search | rex "begin:\s*(?<temp_raw>.*)"| spath input=temp_raw... rest your your search

psidler
Explorer

Hi,

I also had some problems getting the JSON Data into splunk. I have tried the following:

Setting Sourcetype to _json

Added the following to the props.conf:

[_json]
KV_MODE = _json
LINE_BREAKER = "(^){"
SHOULD_LINEMERGE = false
MAX_EVENTS = 3000000
TRUNCATE = 3000000

I used MAX_EVENTS and TRUNCATE because my JSON Events has more ore less 10000 lines.

For xour JSON sample i would use:

[_json]
KV_MODE = _json
LINE_BREAKER = "(^)begin: {"
SHOULD_LINEMERGE = false

Then it should build the events for you:

conn.type = scp
conn.ip = 1.1.1.1
conn.userName = tiger
conn.password =wood
...
...
conn.mainCommandsList.commandSetId = 1234
conn.mainCommandsList.commandSetName = setName
...
...

I hope this is what you are looking for.

Regards,
Patrik

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...