Getting Data In

Splunk 6 query format for JSON data

amanteja
Path Finder

We send JSON formatted data into Splunk. On upgrading to Splunk 6 I noticed that selecting the value of a JSON field no longer filters the query with an spath automatically.
For instance if the JSON data was

{
  level : "Info",
  message : "xxxx"
}

and one clicked on "Info"
in Splunk 5 the query would become

index="x" | spath "level" | search "level"="Info"

While in Splunk 6 it becomes

index="x"  Info

Is there a way to retain the behavior of Splunk 5?

Tags (4)
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

What's happened is that the "spath" has become silent as the extractions are now automatic...

click on the field in the fields list rather than the value in the event.
and select the value you want, in this case:
Field: level
Value: info

You should see: level = info in the search box

This now behaves like any other field, regardless of the format of the raw events.

Clicking on the event text also behaves like any other event regardless of the origins. Of course we maintain the JSON formatting for you in the raw view because JSON has the formatting directives...

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...