Getting Data In

Rename using wildcard

tbo
Explorer

I get some json-formatted logs, that I want to extract a field from. It looks something like the following:

{
    "ack-count": {
        "spout:__ack_init": 12,
        "bolt-one:__ack_ack": 6,
        "bolt-two:__ack_ack": 2,
        "bolt-three:__ack_ack": 4,
        "error-bolt:__ack_ack": 12
    }
}

I need to fetch the value of the field ack-count.spout:__ack_init, here 12, and use it in some calculation. My problem is that I don't know the exact name a priori. I only know that it ends with __ack_init, and lies within the field ack-count. That is, it can be matched with ack-count*__ack_init.

So, what I wanted to do was something like

... | rename ack-count*__ack_init AS acks

But when I try that, I get the error

Error in 'rename' command: Wildcard mismatch: 'ack-count*__ack_init' as 'acks'.

Can anyone tell me how that might be?

By the way, there might be more than one field like that, in which case I would like to sum them, before using them...

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Try doing it this way:

your_search | spath path=ack-count output=a_tmp | rex field=a_tmp "[^:]*:__ack_init\":\s(?<acks>\d)"

Spath takes your json and makes it a string, with which you can do a rex on.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Try doing it this way:

your_search | spath path=ack-count output=a_tmp | rex field=a_tmp "[^:]*:__ack_init\":\s(?<acks>\d)"

Spath takes your json and makes it a string, with which you can do a rex on.

ktwingstrom
Path Finder

Is there a way to accomplish this same principle in a props file? I've got JSON data that has a return{} field that has a big list of software that needs to be updated. But splunk is auto extracting each software name out as part of the field name. I want to do the same thing the OP did and rename all fields called Return* as something else. Can this be done in a conf file? Thanks

0 Karma

tbo
Explorer

Thanks man! Could you update your answer? Then I'll accept it.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

heh, beat me too it. But I would use this:

rex field=a_tmp "[^:]*:__ack_init":\s(?<acks>\d)"

To avoid picking up the other acks.

somesoni2
SplunkTrust
SplunkTrust

try changing rex command above with this.

| rex field=a_tmp "\"[^a-zA-Z_:]:\s\"?(?\d*)"

0 Karma

tbo
Explorer

Thanks. But you have that word "spout" as part of your regex. And I can't be sure that will always be present. The field might be called foo:__ack_init, in which case I suppose the search will fail?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...