Getting Data In

Parsing JSON keys containing dots with SPATH

gcsolaroli
Engager

I have a JSON log where the key of an element contains dots. A brief example:
{
"a.b.c": {
"d": 10
}
}

Using SPATH function with "a.b.c.d" for the path attribute does not work; but I don't know how to express what in Javascript would be ["a.b.c"].d

Any idea on how to handle this case?

Tags (3)

peberhardt
Engager

I would love to know how to do this!

0 Karma

theeansible
Path Finder

Same here.

0 Karma

dart
Splunk Employee
Splunk Employee

Is the whole log JSON?
If so, can you set the KV_MODE to json and see if that gives you the fields you need?

## props.conf
[my_json_data_sourcetype]
KV_MODE = json
0 Karma

tfong_splunk
Splunk Employee
Splunk Employee

What happens if not all the data is JSON? Can I specify by sourcetype?

0 Karma

dart
Splunk Employee
Splunk Employee

What fields do you get in the field picker?

0 Karma

gcsolaroli
Engager

Log content is already recognized as JSON, and Splunk visualizes matching events as expandable objects (instead of plain grid, as it does when showing regular log entries).

But the problem is that if I try to use a key containing dots in its name (e.g. "a.b.c") than Splunk is not able to match it against anything, as it consider it as key "a", containing key "b", containing key "c": { "a": { "b": { "c": "value" } }}

But my log looks like this: { "a.b.c": "value" }

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...