Splunk Enterprise

How to extract a field called "name"?

ejose
Engager

Hi,

I am ingesting a json data that has a property called "name". I could not figure out why I am not able to extract the "name" property as a field name. It also does not create the "name" field even if I use a filed extractor. I am how ever able to create a field called "name1" but if I change it back to "name" it again does not register the field.

Regards,

Edward

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @ejose,

I cannot think of a reason why "name" field name is not working, but if you managed to extract the field as "name1" you can simply rename it on search head on sourcetype settings. You will not need to rename everytime you need.

 

If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @ejose,

I cannot think of a reason why "name" field name is not working, but if you managed to extract the field as "name1" you can simply rename it on search head on sourcetype settings. You will not need to rename everytime you need.

 

If this reply helps you an upvote is appreciated.

scelikok
SplunkTrust
SplunkTrust

Hi @ejose,

If your event is proper JSON you can use spath command. It will extract all fields,

index=json_data | spath

If you have mix data containing some JSON fields inside an event, you can use spath only for that field;

Assuming your json field name is json_field

index=json_data | spath input=json_field

 

 

If this reply helps you an upvote is appreciated.
0 Karma

ejose
Engager

Hi @scelikok ,

Thanks for the reply, but I wanted to extract the field at index time so I can filter it with out having to extract the field every search.

 

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...