Getting Data In

What to do when json field conflicts with Splunk metadata?

pkeller
Contributor

A user is reporting that their indexed json data has a 'source' key that is being extracted.

"source": "[{label:'Tree'},{label:'two'},{label:'Three'}]",

When they search their data, they see:
alt text

They'd like the original source kept intact. Is there a transforms that I can add to my indexers to rename ONLY the json source?

The raw json looks like: [ snipped ]

"toggleMode":"click",
"_toggleMode": {
"desc": "Gets or sets user interaction used for expanding or collapsing any item.",
"type": "enum",
"keys": ["click","dblclick"],
"values": ["click","dblclick"]
},
*
"source": "[{label:'Tree'},{label:'two'},{label:'Three'}]",**
"_source": {
"desc": "Sets the initial contents. Easier to do at runtime.",
"type": "css",
"language": "JavaScript"
},*

Tags (2)

GauravSplunxter
Explorer

transforms.conf
[change_source]
REGEX = "source":\s"[(\S+)]
FORMAT = source::$1
DEST_KEY = MetaData:Source

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...