Splunk Search

Adding additional field from one json field.

jankappe
Explorer

Hi all,

I just started discovering Splunk. I am extracting a file containing JSON data. The data looks something like this:

"DevEUI_uplink": {
        "AckRequested": "1",
        "DevLrrCnt": "5",
        "rawMacCommands": "",
        "Late": "0",
        "ADRbit": "1",
        "LrrLON": "6.440177",
        "payload_hex": "00a0723a032805af1eb9006d4a9b000000",
        "Channel": "LC1",
        "FPort": "4",
        "DevAddr": "15293375"

It's a lot longer but you get the idea. Splunk extracts the field fine however "payload_hex" contains data that needs to be extracted into multiple fields. For example the last for characters will be the temperature. Is it possible to do this? If so, where would I do this and how?

EDIT: suggestions about where to learn this or specific tutorials are welcome as well.

Any help is much appreciated!

0 Karma

hardikJsheth
Motivator

You can do it by adding search time extraction in props.conf.
i.e EVAL-temprature= substr(DevEUI_uplink. payload_hex,0,4)

You can also write REGEX as well. Please refer docs at
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Createandmaintainsearch-timefieldextract...

jankappe
Explorer

Thank you, i will look into it!

0 Karma

DalJeanis
Legend

If that solved your issue, please accept the answer. If it was helpful but did not completely solve the issue, then you can upvote it instead.

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...