Splunk Dev

Get only parsed JSON fields using spath

nagar57
Communicator

I have a below JSON

Recalibration Stats json : {"modelid" : "30013", "champion_gini" : 0.8274502273019728, "recalibResult" : "CASE I Champion Retained", "challenger_gini" : 0.8013221831674033, "recalibDate" : "2020-05-01"}

 

Now to get the JSON fields I have to explicitly mention field names using table/fields. My JSON can get different fields from source so I want to get only parsed fields from JSON by not explicitly mentioning their names. Using below query is giving me all the unwanted fields as well.

index = abx sourcetype = gmdevops_rome source="/axp/gnics/orchestra/dev/romedata/logs/model_run_qc.log" "Recalibration Stats json"
| rex field=_raw "Recalibration Stats json : (?<recalib_stats>.+)"
| spath input=recalib_stats
| table *

Labels (1)
Tags (2)
0 Karma

nagar57
Communicator

It'll be like:

index = abx sourcetype = gmdevops_rome source="/axp/gnics/orchestra/dev/romedata/logs/model_run_qc.log" "Recalibration Stats json"
| rex field=_raw "Recalibration Stats json : (?<recalib_stats>.+)"
| fields recalib_stats
| spath input=recalib_stats
| fields - recalib_stats, _raw, _time
| table *
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, removing _raw and _time as well. The important step is the selecting of recalib_stats field after the rex which removes the bulk of the other fields - the special fields beginning with an underscore have to be remove individually.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure what the question is? Are you trying to remove the "unwanted" fields without mentioning which fields are wanted?

0 Karma

nagar57
Communicator

Yes, I want only parsed fields from JSON. If I use | table * then I want only those fields that are present in JSON. Unwanted fields are date_hour, _raw, _time , date_second etc.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Remove everything apart from recalib_stats after the rex, then remove recalib_stats after the spath

index = abx sourcetype = gmdevops_rome source="/axp/gnics/orchestra/dev/romedata/logs/model_run_qc.log" "Recalibration Stats json"
| rex field=_raw "Recalibration Stats json : (?<recalib_stats>.+)"
| fields recalib_stats
| spath input=recalib_stats
| fields - recalib_stats
| table *

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...