Getting Data In

How to parse/index only json entry from raw data which are in non-uniform pattern?

Boopalan
New Member

How to parse/index only json entry from raw data which are in non-uniform pattern?

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw=" <BOR>
  ExSrc:Schwab.Client.Fx^
  URL:null^
  LogMsg:{\"actor\":{\"Cust\":null,\"Acct\":null,\"Rep\":null,\"System\":null},\"header\":{\"AppId\":null,\"RecId\":\"null\",\"Ver\":\"\",\"StartTS\":\"null\"},\"source\":{\"Ip\":\"*\",\"MacAddress\":null,\"SRCOS\":\"null\",\"SRCRuntime\":null,\"SRCAppName\":null,\"SRCAppVersion\":null,\"SRCReqId\":\"null\",\"CorrelationId\":\"null\",\"SourceId\":null,\"Uri\":\"null\"}}^
  ExType:Common.Exceptions.ServiceCommunicationException^
  <EOR>" 
| rex "(?<json>(?={).+})" 
| spath input=json 
| table actor* header* source*

Extracting in search, like this.

0 Karma

Boopalan
New Member

Is there anyway to make this possible through configuration changes while parsing/indexing the log file itself

0 Karma

to4kawa
Ultra Champion

sorry, I can't. please ask others.
please tell me why do you want while parsing/indexing the log file itself?
Is collect bad?

0 Karma

Boopalan
New Member

From the below raw data only json need to be extracted/indexed in the splunk and should be viewed as json structured view while searching this logs on search head

<BOR>
ExSrc:Schwab.Client.Fx^
URL:null^
LogMsg:{"actor":{"Cust":null,"Acct":null,"Rep":null,"System":null},"header":{"AppId":null,"RecId":"null","Ver":"","StartTS":"null"},"source":{"Ip":"*","MacAddress":null,"SRCOS":"null","SRCRuntime":null,"SRCAppName":null,"SRCAppVersion":null,"SRCReqId":"null","CorrelationId":"null","SourceId":null,"Uri":"null"}}^
ExType:Common.Exceptions.ServiceCommunicationException^
<EOR>
0 Karma
Get Updates on the Splunk Community!

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering. Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...