Getting Data In

Spath parsing error, last event in JSON

DanielFordWA
Contributor

I have the following JSON in each event

payload={fields1=values1, field2=value2, etc}

When running spath I encounter an error with an parameter called eventTime.

 my search | spath input=payload

if the eventTime parameter is the last parameter in the JSON blob it will not parse correctly.

payload={fields1=values1,....., eventTime=2017-02-20 15:43:53 432}

Splunk will parse the value as

eventTime=2017-02-20

If the eventTime parameter is in any other location in the JSON then the parameter will parse correctly.

 payload={fields1=values1,......,eventTime=2017-02-20 15:46:02 154,fieldsn=valuesn,...etc}

Splunk will parse the parameter as

eventTime=2017-02-20 15:46:02 154

Does anyone know how to correct this in Splunk or do I need to request a change in logging?

Thanks,

Dan

0 Karma

jkat54
SplunkTrust
SplunkTrust

It's improper JSON. The DATETIME stamp should be quoted.

You can use rex mode=sed to add quotes at search time prior to the spath command.

  ...| rex mode=sed field=payload 's/(eventTime\=)(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\s+\d{3})/\1"\2"/g'

jkat54
SplunkTrust
SplunkTrust

Not 100% on that sed command but something like that should work.

0 Karma

DanielFordWA
Contributor

the sed command is not working but its enough to go on!

I'll make sure the JSON is correct.

Thanks,

Dan

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...