Getting Data In

Need to remove prefix from json array.

vin02ptl
Explorer

Need to remove prefix from json array. I want to remove everything before {"id"

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#auditLogs/directoryAudits","value":[{"id"

Tags (1)
0 Karma

to4kawa
Ultra Champion

props.conf

[odata]
CHARSET=UTF-8
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTION = none
KV_MODE = json
LINE_BREAKER = (.*:\[){\"id|}(,)|(\]})
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
disabled = false

please modify DATETIME_CONFIG

If you don't present your log properly(you should use code sample), you can't expect a response.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vin02ptl,
please, could you share an example of your logs?
Anyway, I solved this problem with this regex:

| rex "[^\{]*(?<all>.*)"

Ciao.
Giuseppe

0 Karma

vin02ptl
Explorer

@gcusello please have a look and advice

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vin02ptl,
Thy this regex

\"id\":\"(?<id>[^\"]+)\",\"category\":\"(?<category>[^\"]+)\",\"correlationId\":(?<correlationId>[^\"]+),\"activityDateTime\":\"(?<activityDateTime>[^\"]+)

that you can test at https://regex101.com/r/StogWZ/1

Ciao.
Giuseppe

0 Karma

vin02ptl
Explorer

i just want to remove header part during indexing remaining parsing field regex i can write....

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...