Spath parsing error, last event in JSON

[DanielFordWA]

I have the following JSON in each event

payload={fields1=values1, field2=value2, etc}

When running spath I encounter an error with an parameter called eventTime.

 my search | spath input=payload

if the eventTime parameter is the last parameter in the JSON blob it will not parse correctly.

payload={fields1=values1,....., eventTime=2017-02-20 15:43:53 432}

Splunk will parse the value as

eventTime=2017-02-20

If the eventTime parameter is in any other location in the JSON then the parameter will parse correctly.

 payload={fields1=values1,......,eventTime=2017-02-20 15:46:02 154,fieldsn=valuesn,...etc}

Splunk will parse the parameter as

eventTime=2017-02-20 15:46:02 154

Does anyone know how to correct this in Splunk or do I need to request a change in logging?

Thanks,

Dan

[jkat54]

It's improper JSON. The DATETIME stamp should be quoted.

You can use rex mode=sed to add quotes at search time prior to the spath command.

  ...| rex mode=sed field=payload 's/(eventTime\=)(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s+\d{3})/\1"\2"/g'

[jkat54]

Not 100% on that sed command but something like that should work.

[DanielFordWA]

the sed command is not working but its enough to go on!

I'll make sure the JSON is correct.

Thanks,

Dan