Getting Data In

Parsing JSON with spath command is not returning expected results.

jbutorac3
New Member

I have tried to get after.merchantId a million different ways, but it always comes back blank. I believe I'm missing the obvious:

Search String:
sourcetype="json" auditId=RECIPIENT_ADDED | spath | table _time, after.merchantId
...only _time has values, nothing else

sourcetype="json" auditId=RECIPIENT_ADDED | spath | rename after.merchantId as merchantId, after.leadDays as leadDays | eval x=mvzip(merchantId,leadDays) | table _time,merchantId,leadDays,x
...only _time has values, nothing else


Sample JSON:
{   
     @timestamp:     2018-09-09T19:05:50.077Z   
     @version:   1  
     actingProfileType:  ALL    
     after:  {"phoneNumber":"8005551212","recipientNumber":"************1111","merchantId":"111111112","paperPaymentEnabled":"true","leadDays":"5","Nickname":"Bob Evans","addressOnFile":"false","recipientName":"Bobby Evans","transferMethod":"PAYMENT","merchantZipRequired":"false","providerStatus":"ACTIVE","merchantName":"Bobby Evans"}    
     application:    BACKOFFICE 
     auditId:    RECIPIENT_ADDED    
     browserName:    Chrome 
     browserVersion:     68.0.3440.106  
     clientIp:   192.0.0.1  
     companyId:  11113  
     component:  PAYMENTS   
     instanceId:     1abc2345-67de      
     userId:     11111114   
     userSourceId:   2fgh3456-89ij      
}
0 Karma

DalJeanis
Legend

1) Your JSON is missing required commas between key-value pairs.

2) The colons in the time field are confusing the parsing algorithm. In addition, it seems to be breaking each value and inserting space before periods, between pure alpha, pure decimal, and hyphens, and so on.

3) Parsing worked perfectly when we added the required commas and surrounded all keys and values with quotes, but beyond that, we couldn't tell you what other issues there might have been.

0 Karma

somesoni2
Revered Legend

The spath command works when your json data is in pure json format. You can use https://jsonlint.com/ to confirm if you raw data is a valid json.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...