Getting Data In

JSON Split at Index Time

krishnakesiraju
Explorer

Hi all,

I have a JSON file output from a RESTful API service and the log looks something like this:

{
"Provider": "Provider1",
"AccountId": "Account1",
"Status": "NON_COMPLIANT",
"AggregatedStatus": {
"Control1": "COMPLIANT",
"Control2": "NON_COMPLIANT",
"Control3": "COMPLIANT"
},
"ResourceCounter": 3,
"DetailedResult": [
{
"RuleName": "Rule1",
"ResourceID": "ID65329083",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control1",
"SubCategory": "SubCat1"
},
{
"RuleName": "Rule2",
"ResourceID": "ID234ti4",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control2",
"SubCategory": "SubCat2"
},
{
"RuleName": "Rule3",
"ResourceID": "ID7523427",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control3",
"SubCategory": "SubCat3"
}
]
}

Is it possible to split the JSON into multiple events and filter/index the output based on "Category": "Control2". Ideally, I would like to view the broken down events like this and may be filter events based on the "Category" field. Is this even possible?

{
"Provider": "Provider1",
"AccountId": "Account1",
"Status": "NON_COMPLIANT",
"AggregatedStatus": {
"Control1": "COMPLIANT"
},
"ResourceCounter": 1,
"DetailedResult": [
{
"RuleName": "Rule1",
"ResourceID": "ID65329083",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control1",
"SubCategory": "SubCat1"
}
]

}

{
"Provider": "Provider1",
"AccountId": "Account1",
"Status": "NON_COMPLIANT",
"AggregatedStatus": {
"Control2": "NON_COMPLIANT"
},
"ResourceCounter": 1,
"DetailedResult": [
{
"RuleName": "Rule2",
"ResourceID": "ID234ti4",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control2",
"SubCategory": "SubCat2"
}
]
}


{
"Provider": "Provider1",
"AccountId": "Account1",
"Status": "NON_COMPLIANT",
"AggregatedStatus": {
"Control3": "COMPLIANT"
},
"ResourceCounter": 1,
"DetailedResult": [
{
"RuleName": "Rule3",
"ResourceID": "ID7523427",
"ResourceType": "Type1",
"Timestamp": "2019-07-25T06:53:13.030000",
"Status": "NON_COMPLIANT",
"Severity": "medium",
"Category": "Control3",
"SubCategory": "SubCat3"
}
]
}

Thanks,
Krishna

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you need to create a scripted input to break the file up like that.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>