Getting Data In

Lift fields in nested json object to top level

Explorer

I have json data like this

{
  "default": 3
  "payload": { "a": 1,  "b": 4 }
}

The keys in my payload object differ for different usecases and I want to lift all the key-value pairs in the payload property to top level.
I.e I don't want to query 'payload.a' but simply 'a'.
With a fixed set of keys I could do this transformation in props.conf but as I said the keys of the payload object vary.

Is it possible to lift the contents of a nested object?
"spath output=$MAGIC path=payload.$MAGIC"

The best of what I can think at the moment is a (python) custom command, which does the trick, but you know ...
Sure there is a better way?!

PS: We are on splunk 6.4

0 Karma

Revered Legend

YOu could just simply rename the fields to remove payload. portion (using rename command in search OR creating field alias in props.conf/settings->Fields).

... | rename payload.* as *

https://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Configurefieldaliaseswithprops.conf

Explorer

Hi somesoni2, thanks for your answer!

I didn't knew about that I could it like that "rename stuff.* AS *". This definitely helps.

I would like to port this to my props.conf, but it doesn't work yet.

I tried

[<my_sourcetype>]
KV_MODE=json
FIELDALIAS-payload_general = payload.* AS *

but it has no effect whatsoever.
Is FIELDALIAS supposed to work with wildcards as well?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!