Getting Data In

Need to remove prefix from json array.

vin02ptl
Explorer

Need to remove prefix from json array. I want to remove everything before {"id"

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#auditLogs/directoryAudits","value":[{"id"

Tags (1)
0 Karma

to4kawa
Ultra Champion

props.conf

[odata]
CHARSET=UTF-8
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTION = none
KV_MODE = json
LINE_BREAKER = (.*:\[){\"id|}(,)|(\]})
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
disabled = false

please modify DATETIME_CONFIG

If you don't present your log properly(you should use code sample), you can't expect a response.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vin02ptl,
please, could you share an example of your logs?
Anyway, I solved this problem with this regex:

| rex "[^\{]*(?<all>.*)"

Ciao.
Giuseppe

0 Karma

vin02ptl
Explorer

@gcusello please have a look and advice

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vin02ptl,
Thy this regex

\"id\":\"(?<id>[^\"]+)\",\"category\":\"(?<category>[^\"]+)\",\"correlationId\":(?<correlationId>[^\"]+),\"activityDateTime\":\"(?<activityDateTime>[^\"]+)

that you can test at https://regex101.com/r/StogWZ/1

Ciao.
Giuseppe

0 Karma

vin02ptl
Explorer

i just want to remove header part during indexing remaining parsing field regex i can write....

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...