Getting Data In

Lift fields in nested json object to top level

dwh_splunk
Explorer

I have json data like this

{
  "default": 3
  "payload": { "a": 1,  "b": 4 }
}

The keys in my payload object differ for different usecases and I want to lift all the key-value pairs in the payload property to top level.
I.e I don't want to query 'payload.a' but simply 'a'.
With a fixed set of keys I could do this transformation in props.conf but as I said the keys of the payload object vary.

Is it possible to lift the contents of a nested object?
"spath output=$MAGIC path=payload.$MAGIC"

The best of what I can think at the moment is a (python) custom command, which does the trick, but you know ...
Sure there is a better way?!

PS: We are on splunk 6.4

0 Karma

somesoni2
SplunkTrust
SplunkTrust

YOu could just simply rename the fields to remove payload. portion (using rename command in search OR creating field alias in props.conf/settings->Fields).

... | rename payload.* as *

https://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Configurefieldaliaseswithprops.conf

dwh_splunk
Explorer

Hi somesoni2, thanks for your answer!

I didn't knew about that I could it like that "rename stuff.* AS *". This definitely helps.

I would like to port this to my props.conf, but it doesn't work yet.

I tried

[<my_sourcetype>]
KV_MODE=json
FIELDALIAS-payload_general = payload.* AS *

but it has no effect whatsoever.
Is FIELDALIAS supposed to work with wildcards as well?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...