Getting Data In

Not able to parse json with spath ,something wrong but not json

ekmek4
Explorer

Hi,

I need to ingest some logs into splunk, so file&dirs data input its my choice.

Also new index was created , _json as sourcetype. Now im trying to use spath in search to parse JSON data with multifields and no luck yet. Just checked my json file - valid json.

ekmek4_0-1740504817781.png

Here we have some parsed json, but i want to get email, first_name,last_name from properties.attributes to be able parse or filter by any of this fields in future

 

Appreciate any help.

Small source file:

https://paste2.org/OsEXkgbJ

 

Here is what i tried :

index=ep_log event=created | spath properties.attributes

index=erp_log event=created | spath properties and so on

Labels (1)
0 Karma
1 Solution

ekmek4
Explorer

index=ep_log event=created | spath path=properties | mvexpand properties | spath input=properties

This query automatically expand fields with every attribute key. 

View solution in original post

0 Karma

ekmek4
Explorer

index=ep_log event=created | spath path=properties | mvexpand properties | spath input=properties

This query automatically expand fields with every attribute key. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| spath properties
| spath input=properties attributes

ekmek4
Explorer

Now i have a new field "attributes"

attributes: 

 {"email": "gacilia@gmail.com", "clients": {"ERP Frontend": "GEgzvJrIJxxHNS9FVdSvUej5wyrBgd2sSHH7RLuE", "Frontend CRM": "ILrkYrSCSsKgdgxBRv0COxKLaOzKufXogzWEAoh8"}, "is_active": false, "last_name": "Gac", "legacy_id": "66f510fea8f5e1ff130f5fa0", "first_name": "Ilia", "start_date": null, "is_team_supervisor": true, "two_factor_auth_enabled": false}

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this give you what you want?

| spath properties
| spath input=properties attributes
| spath input=attributes
0 Karma

ekmek4
Explorer
| spath path=properties | mvexpand properties | spath input=properties

 

this works fine for me. Thank you!!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...