Getting Data In

How to parse a field that has flat log text and in JSON format?

brent_weaver
Builder

Need some help here. I have the following event:

Feb 14 14:40:01 10.64.61.104 {"protocol": {"protocol": "ip", "app": "http", "session_id": "CzbhnXwfgz1jyPljh", "event_status": "1", "headers_server": "AmazonS3", "transport": "TCP", "dest_port": "50320", "src_port": "80", "event_id": "58a316458a2056136296f1e1", "headers_user-agent": "EventMachine HttpClient", "headers_content-type": "application/zip", "ftype": "gzip", "fname": "cflinuxfs2", "sha256": "db1b2669c46e93c60058e7dd0629c7e609f07bb158e94c8ee0451d2e0774fe7f", "headers_uri": "/system.asv-pr.ice.predix.io-cc-droplets/buildpack_cache/bf/17/bf178b85-8904-4bb6-b022-418e80a28da4/cflinuxfs2?AWSAccessKeyId=cfservices&Signature=FGAHR74Jeg0CeKUSqIXT3rSNitw=&Expires=1487086672", "dest": "10.131.16.223", "timestamp": "2017-02-14 14:37:57.012000", "host": "storecf.gecis.io", "user": "UNKNOWN", "headers_host": "storecf.gecis.io", "md5": "7c6f3b66919b7b8927f684e6d8782489", "src": "10.64.37.22", "dvc": "vna-bv-nw02i"}

I would like to be able to parse out the JSON which should make it into key/value pairs if I am not mistaken. How is this accomplished?

Thanks!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You should set kv_mode = json in your props.conf

Don't forget to restart the Splunk service after

http://docs.splunk.com/Documentation/Splunk/6.5.2/admin/Propsconf

0 Karma

somesoni2
Revered Legend

You can use following do this inline at search time.

your base search | rex "^(\S+\s+){4}(?<json_data>.+)" | spath input=json_data
0 Karma

brent_weaver
Builder

How do I adapt that to my props and transforms?

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...