Getting Data In

Is there a way to use kv_mode=json and eliminate one level in spath?

dominiquevocat
Motivator

Is there a way to use kv_mode=json and remove levels of nesting during indexing or later?

Example: we jave some json (jboss) that looks like this:

{
    "outcome" : "success",
    "result" : {
        "name" : "32740@chhs-ssys060",
        "vm-name" : "Java HotSpot(TM) 64-Bit Server VM",
        "vm-vendor" : "Sun Microsystems Inc.",
        "vm-version" : "20.60-b01",
        "spec-name" : "Java Virtual Machine Specification",
        "spec-vendor" : "Sun Microsystems Inc.",
        "spec-version" : "1.0",

resulting in fields that are named result.name, result.vm-version etc.
My goal is to remove the top level node "result" so the fields names are "cleaner" i.e. name, vm-version.

It is a somewhat narrow usecase because all results i want are in the node "result". If it is not too taxing one could probably do a eval on any result.* field and rename it during search time to *? what would be the best way to do so? Is there a easy option for the spath or kv_mode=json that i overlooked?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The simplest solution would be to configure field alias on your search head to rename all result.FieldName to just FieldName. A sample props.conf for the same would be like this

props.conf on Search Head

[Your sourcetype]
...other configurations...
FIELDALIAS-result = result.* as *

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The simplest solution would be to configure field alias on your search head to rename all result.FieldName to just FieldName. A sample props.conf for the same would be like this

props.conf on Search Head

[Your sourcetype]
...other configurations...
FIELDALIAS-result = result.* as *

dominiquevocat
Motivator

looks good, think its no performance penalty.
Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...