Getting Data In
Highlighted

How to print multiple JSON root elements?

Engager

Hi,

I've data like this

{
"container_id":"0fce97fd907a806802eab9b27965dd35dd82bbe142d128294b34b8a8a2e42f23",
"container_name":"nginx",
"name":"eventBase0"
}
{
"name":"eventBase1",
"hostname":"google.com",
"pid":7
}

This above format are contain 2 multiple json root elements which second value "eventBase1" not shown on interesting fields in splunk dashboard. My output format is i want to get the second value and print on a table such as below.

+++++++++++++++++++++++++++++++
+++ name | hostname | pid +++

Thanks

0 Karma
Highlighted

Re: How to print multiple JSON root elements?

Esteemed Legend

Like this:

| makeresults 
| eval _raw="{
\"container_id\":\"0fce97fd907a806802eab9b27965dd35dd82bbe142d128294b34b8a8a2e42f23\",
\"container_name\":\"nginx\"
    }
{
\"name\":\"eventBase1\",
\"hostname\":\"google.com\",
\"pid\":7
}"

| rename COMMENT AS "Everything above generates sample events; everything below is your solution"

| rex mode=sed "s/([\r\n\s]+\})([\r\n\s]+\{[\r\n\s]+)/\1::::{\n/g"
| rename _raw AS raw
| makemv delim="::::" raw
| mvexpand raw 
| rename raw AS _raw
| spath
0 Karma
Highlighted

Re: How to print multiple JSON root elements?

Engager

For this command above, i need to concat all string with "\", the line of json format are very long, above is only example code, is there any other way to get only for second json root elements ?

| eval raw="{
\"container
id\":\"0fce97fd907a806802eab9b27965dd35dd82bbe142d128294b34b8a8a2e42f23\",
\"container_name\":\"nginx\"
}
{
\"name\":\"eventBase1\",
\"hostname\":\"google.com\",
\"pid\":7
}"

0 Karma
Highlighted

Re: How to print multiple JSON root elements?

Esteemed Legend

You are TOTALLY missing the point. Read the line that is singled out. It says Everything above generates sample events; everything below is your solution. You only need the stuff below that line, the portion that begins with | rex ....

0 Karma
Highlighted

Re: How to print multiple JSON root elements?

Contributor

Hi @amirrachman The problem here is you don't have your data as correct JSON format that's why Splunk couldn't extract those fields... If you want auto extraction you should have the following format in your case:

[{
     "container_id":"0fce97fd907a806802eab9b27965dd35dd82bbe142d128294b34b8a8a2e42f23",
     "container_name":"nginx"
     },
     {
     "name":"eventBase1",
     "hostname":"google.com",
     "pid":7
     }]

i.e. JSON array

0 Karma
Highlighted

Re: How to print multiple JSON root elements?

Engager

hi @harshpatel yes, in this case, the logs is not have correct json format, for reformating, yes I create an concat array, then how i got the second value which I want ?

{
 "name":"eventBase1",
 "hostname":"google.com",
 "pid":7
 }
0 Karma
Highlighted

Re: How to print multiple JSON root elements?

Contributor

Hi @amirrachman ,

You can either manually extract it at search time using rex command like:

| rex field=_raw "\"name\":\"(?<name>\w+)\""

OR
You can reformat your data so that it is in proper JSON format so Splunk can auto extract fields for you. I would recommend the latter.

View solution in original post

Highlighted

Re: How to print multiple JSON root elements?

Engager

Hi @harshpatel, the json that I've is like below.
so I have both "name" field on the json files (I just revise my question on above). within those both "name", i want to take "name" on second value "eventBase1"

{
    "container_id":"0fce97fd907a806802eab9b27965dd35dd82bbe142d128294b34b8a8a2e42f23",
    "container_name":"nginx",
    "name":"eventBase0"
    }
    {
    "name":"eventBase1",
    "hostname":"google.com",
    "pid":7
    }
0 Karma
Highlighted

Re: How to print multiple JSON root elements?

Contributor

Try this:

| rex field=_raw "{\s*\"name\":\"(?<name>\w+)\""
0 Karma
Highlighted

Re: How to print multiple JSON root elements?

Engager

Thank @harshpatel it's working perfect as I want

0 Karma