Splunk Dev

How to extract json value fields?

karthi2809
Builder

"reqUser":"mhundi","evtTime":"2023-06-08 14:04:06.504","access":"SELECT","resource":"dsc60180_ici_sde_tz_db/vehicle_master/light_truck_lob_flag,lincoln_lob_flag,model_e_lob_flag,vehicle_make_desc,vehicle_type_desc,warranty_start_date,vehicle_type_desc,warranty_start_date","resType":"@column","action":"select","result":1,"agent":"hiveServer2","policy":101343,"enforcer":"ranger-acl","sess":"00ef27f9-75a4-4821-9e8a-60f16af6b962","cliType":"HIVESERVER2","cliIP":"19.51.78.185","reqData":"SELECT * FROM (SELECT `Left`.`advisor_name`, `Left`.`appointment_created_by`, `Left`.`appointment_datetime

 

Fields to be extract 

reqUser, evtTime, resource

 

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this is not a json data. It could be part of if but not really full, working json.

If you have full json, it should be usable without any difficulties e.g. with spath if/when onboarding has done correctly.

If it's not working json then you must use e.g. rex command to get wanted values from _raw event.

| rex "\"reqUser\":\"(?<reqUser>[^\"]+)\",\"evtTime\":\"(?<evtTime>[^\"]+)\","
| rex "\"resource\":\"(?<resource>[^\"]+)\""
| table reqUser evtTime resource 

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...