Getting Data In

How to parse json field?

rodrwan
New Member

Hello friends, first of all sorry because my english isn't fluent...

I've been searching similar questions, but anyone solved my problem.

In my search code, I have a JSON geolocalization field as follows:

{'latitude' : '-19.9206813889499', 'longitude' : ' '}   

I just want to split it up in two collumns.

How can I do this?

Regards

Tags (3)
0 Karma
1 Solution

mayurr98
Super Champion

hey

Try this run anywhere search

| makeresults 
| eval _raw="{'latitude' : '-19.9206813889499', 'longitude' : ' '}" 
| rex field=_raw "{'latitude'\s:\s'(?<latitude>[^\']*)',\s'longitude'\s:\s'(?<longitude>[^\']+)"

In your environment you should write,

<your_base_search>
| rex field=_raw "{'latitude'\s:\s'(?<latitude>[^\']*)',\s'longitude'\s:\s'(?<longitude>[^\']+)"

let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

hey

Try this run anywhere search

| makeresults 
| eval _raw="{'latitude' : '-19.9206813889499', 'longitude' : ' '}" 
| rex field=_raw "{'latitude'\s:\s'(?<latitude>[^\']*)',\s'longitude'\s:\s'(?<longitude>[^\']+)"

In your environment you should write,

<your_base_search>
| rex field=_raw "{'latitude'\s:\s'(?<latitude>[^\']*)',\s'longitude'\s:\s'(?<longitude>[^\']+)"

let me know if this helps!

0 Karma

rodrwan
New Member

Thank you all, the solution posted by mayurr98 have solved my problem!

0 Karma

cmerriman
Super Champion

try adding something like this:

|rex field=data "'latitude' : '(?<latitude>.*)', 'longitude' : '(?<longitude>.*)'"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...