Getting Data In

Spath parsing error, last event in JSON

DanielFordWA
Contributor

I have the following JSON in each event

payload={fields1=values1, field2=value2, etc}

When running spath I encounter an error with an parameter called eventTime.

 my search | spath input=payload

if the eventTime parameter is the last parameter in the JSON blob it will not parse correctly.

payload={fields1=values1,....., eventTime=2017-02-20 15:43:53 432}

Splunk will parse the value as

eventTime=2017-02-20

If the eventTime parameter is in any other location in the JSON then the parameter will parse correctly.

 payload={fields1=values1,......,eventTime=2017-02-20 15:46:02 154,fieldsn=valuesn,...etc}

Splunk will parse the parameter as

eventTime=2017-02-20 15:46:02 154

Does anyone know how to correct this in Splunk or do I need to request a change in logging?

Thanks,

Dan

0 Karma

jkat54
SplunkTrust
SplunkTrust

It's improper JSON. The DATETIME stamp should be quoted.

You can use rex mode=sed to add quotes at search time prior to the spath command.

  ...| rex mode=sed field=payload 's/(eventTime\=)(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s+\d{3})/\1"\2"/g'

jkat54
SplunkTrust
SplunkTrust

Not 100% on that sed command but something like that should work.

0 Karma

DanielFordWA
Contributor

the sed command is not working but its enough to go on!

I'll make sure the JSON is correct.

Thanks,

Dan

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...