Splunk Enterprise

How to create regex for Array of objects while creating indexed-fields

nagendraDumpala
Engager

We have an object like below.

{ "mirId": "Mule-111", "appVersion": "v1", "businessGroup": "MARKETING", "compress": false, "appName": "dev-sys-netsuite-int-v1", "relational_correlationId": "c96563d1-acb3-11ea-9d9b-0654f1d3f281", "tracePointDescription": "Capture payload", "threadName": "[MuleRuntime].cpuLight.13: [adaptive-logger-test].adaptive-loggerFlow.CPU_LITE @6dbce5f9", "content": { "exception": "", "payload": "https://s3.console.aws.amazon.com/s3/object/unilever-ai-operationalframework/LEVEREDGE/prod/dispatch...", "businessFields": [ { "key": "File_Name", "value": "ASN_200622170087026.xml" }, { "key": "IDOC_NAME", "value": "0000001408187026" } ], "category": "org.unilever.apps.adaptiveloggertest" }, "environment": "TJ-MARKETING-Dev", "LogMessage": "Test-TJ-SCHED", "correlationId": "c98f8110-acb3-11ea-9d9b-0654f1d3f281", "interfaceName": "netsuite-salesapi", "tracePoint": "START", "timestamp": "2020-12-06T13:59:21.133Z" }

Now we need to create a regex for matching the key & value from businessFields array. And the values of "key" , "value" should be stored as multi-value fields. we need to use this regex in transforms.conf for creating indexed-fields.

Labels (2)
Tags (2)
0 Karma
1 Solution

Birbal
Engager

Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)?

View solution in original post

0 Karma

Birbal
Engager

Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)?

0 Karma

nagendraDumpala
Engager

Hi Birbal,

 

Thank you so much for your support.  Your suggestion make my job very cool.

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...