Getting Data In
Highlighted

Trying to parse my Json into a table

Communicator

this is the format:

{
"epoch": "1485892851.94944",
"id": "3952418",
"name": "WMI Performance Adapter",
"newattrs": "{\"DisplayName\":\"WMI Performance Adapter\",\"ServiceName\":\"wmiApSrv\",\"enabled\":\"Manual\",\"state\":\"Running\",\"User\":\"localSystem\"}",
"new
scanid": "513186",
"node
environmentid": "2",
"node
id": "153",
"nodename": "servername",
"node
primarynodegroupid": "68",
"old
attrs": "{\"DisplayName\":\"WMI Performance Adapter\",\"ServiceName\":\"wmiApSrv\",\"enabled\":\"Manual\",\"state\":\"Stopped\",\"User\":\"localSystem\"}",
"oldscanid": "513150",
"path": "{services,windows}",
"status": "modified",
"type": "services",
"updated_at": "2017-01-31 20:00:51.949442"
}

trying to use the spath

Tags (3)
0 Karma
Highlighted

Re: Trying to parse my Json into a table

Splunk Employee
Splunk Employee

I believe this is what you are looking for:
I selected one field from newattr and oldattr because it is the only one that differs. Otherwise you can't see what's happening.

 index=blah sourcetype=blah 
| spath input=new_attrs 
|rename state AS newState
|spath input=old_attrs
|rename state AS oldState
|table newState oldState

But you would simply rename the ones you wanted. ie rename state as newState, DisplayName AS newDisplay, ServiceName AS Fred

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

0 Karma
Highlighted

Re: Trying to parse my Json into a table

Communicator

Thanks Producer! This is along the lines of what I was visioning.

0 Karma
Highlighted

Re: Trying to parse my Json into a table

Splunk Employee
Splunk Employee

woohoo! Excellent. 🙂

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma