Getting Data In

How to parse a field that has flat log text and in JSON format?

brent_weaver
Builder

Need some help here. I have the following event:

Feb 14 14:40:01 10.64.61.104 {"protocol": {"protocol": "ip", "app": "http", "session_id": "CzbhnXwfgz1jyPljh", "event_status": "1", "headers_server": "AmazonS3", "transport": "TCP", "dest_port": "50320", "src_port": "80", "event_id": "58a316458a2056136296f1e1", "headers_user-agent": "EventMachine HttpClient", "headers_content-type": "application/zip", "ftype": "gzip", "fname": "cflinuxfs2", "sha256": "db1b2669c46e93c60058e7dd0629c7e609f07bb158e94c8ee0451d2e0774fe7f", "headers_uri": "/system.asv-pr.ice.predix.io-cc-droplets/buildpack_cache/bf/17/bf178b85-8904-4bb6-b022-418e80a28da4/cflinuxfs2?AWSAccessKeyId=cfservices&Signature=FGAHR74Jeg0CeKUSqIXT3rSNitw=&Expires=1487086672", "dest": "10.131.16.223", "timestamp": "2017-02-14 14:37:57.012000", "host": "storecf.gecis.io", "user": "UNKNOWN", "headers_host": "storecf.gecis.io", "md5": "7c6f3b66919b7b8927f684e6d8782489", "src": "10.64.37.22", "dvc": "vna-bv-nw02i"}

I would like to be able to parse out the JSON which should make it into key/value pairs if I am not mistaken. How is this accomplished?

Thanks!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You should set kv_mode = json in your props.conf

Don't forget to restart the Splunk service after

http://docs.splunk.com/Documentation/Splunk/6.5.2/admin/Propsconf

0 Karma

somesoni2
Revered Legend

You can use following do this inline at search time.

your base search | rex "^(\S+\s+){4}(?<json_data>.+)" | spath input=json_data
0 Karma

brent_weaver
Builder

How do I adapt that to my props and transforms?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...