Getting Data In
Highlighted

linebreaker for json sourcetype

Explorer

I am trying to break the below json data into each event

{"auditlogs": [{"url": "https://Company.udesk.com/api/v2/auditlogs/3650750.json", "id": 3650750, "actorid": 27401, "sourceid": 36012509503, "sourcetype": "view", "sourcelabel": "View: Copy of ALL CX BC", "action": "create", "changedescription": "", "ipaddress": "116.10.16.1", "createdat": "2019-12-13T06:04:32Z", "user": "VASU JOGI"}, {"url": "https://Company.udesk.com/api/v2/auditlogs/365073140614.json", "id": 365073140614, "actorid": 28319638, "sourceid": 3600001411, "sourcetype": "accountsetting", "sourcelabel": "Account Assumption", "action": "update", "changedescription": "Changed", "ipaddress": "160.12.15.26", "createdat": "2019-12-12T22:18:14Z", "user": "Sejal Jack"}]}

from the above log event 1 should be as below and rest of the message should be another event.
{"url": "https://Company.udesk.com/api/v2/audit_logs/3650750.json", "id": 3650750, "actorid": 27401, "sourceid": 36012509503, "sourcetype": "view", "sourcelabel": "View: Copy of ALL CX BC", "action": "create", "changedescription": "", "ipaddress": "116.10.16.1", "created_at": "2019-12-13T06:04:32Z", "user": "VASU JOGI"},

Below is my Props.conf which is deployed on UF. Please help to get it working

[json]
LINE
BREAKER = (,*\s+){"url"
SHOULD_LINEMERGE = false

0 Karma
Highlighted

Re: linebreaker for json sourcetype

Explorer

Use the path command mit curl braces.

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Spath

|spath input=raw output=events path=auditlogs{}

0 Karma
Highlighted

Re: linebreaker for json sourcetype

Explorer

No it is not working? is it possible to do it via props file?

0 Karma
Highlighted

Re: linebreaker for json sourcetype

Explorer

The input of _raw need to be the blank JSON String

0 Karma
Highlighted

Re: linebreaker for json sourcetype

Explorer

yes i tried, but no luck? is it not possible to do the parsing via props.conf .I am looking for search time field extraction.

0 Karma
Highlighted

Re: linebreaker for json sourcetype

Ultra Champion

props.conf

[audit_json]
SEDCMD-trim = s/^.*\[(.*)\]}/\1/g
LINE_BREAKER = }(,)
KV_MODE = json
SHOULD_LINEMERGE = false
0 Karma
Highlighted

Re: linebreaker for json sourcetype

Communicator

try using below-mentioned search for your json index

search
   | rex "(?<json>\{.+)" | spath input=json | fields - json  
0 Karma