Is it possible to perform field extraction on a string inside a JSON object?

[scottsnow]

Given a log in JSON format, such as:
{
a: "some data",
b: "some more data",
c: "field1=data1 \t field2=data2"
}

How would I perform automatic field extraction on field "c"? I'd like "field1" and "field2" to show up in interesting fields.

I found a (somewhat finicky) way using regex, but it can break depending on separators. Plus, we have to specify the regex as searching for that exact key. Is there any way to just automatically take the string inside c and parse it for interesting fields?

[harsmarvania57]

Hi @scottsnow,

So here I have created same query which shows how you can break data from c and here I am assuming that data1 and data2 are alphabetic only.

| makeresults
| eval _raw="{
\"data\": [
  {
  \"a\":\"some data\",
  \"b\":\"some more data\",
  \"c\":\"field1=data1 \t field2=data2\"
  }
  ]
}"
| spath
| rename data{}.c AS c
| rex field=c "field1=(?<first_field>\w+).*field2=(?<second_field>\w+)"

I hope this helps.

EDIT: If you want to extract this field automatically then I assume that you already have interesting field c on left hand side in your splunk so here you can create field extraction for your sourcetype and you can give regular expression as field1=(?<first_field>\w+).*field2=(?<second_field>\w+) which will automatically extract first_field and second_field in interesting field.

[scottsnow]

Useful for searches, useless for automatic field extraction.

[amcjohn]

Try using spath: https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Spath

[scottsnow]

Doesn't help for automatic field extraction (as far as I can tell). Of course it's fine for searches/alerts, but looking for fields to be automatically extracted from a string in a JSON object.