Splunk Search

Can Splunk dynamically extract JSON Key names while joining the event with other sourcelogs?

lpolo
Motivator

The following query is able to join two source logs where one of the source logs is in json format:

(sourcetype="request" AND application=vsp NOT (Agent.007) key_name1 )
 OR
(sourcetype="response" key_name2)
| spath
| spath path=your_json_path output=your_output_key_name1
| spath path=your_json_path output=your_output_key_name2
| spath path=your_json_path output=your_output_key_name3
...
| spath path=your_json_path output=your_output_key_name4
stats
 first(your_output_key_name1) as your_output_key_name1
 first(your_output_key_name2) as your_output_key_name2
 first(your_output_key_name3) as your_output_key_name3
 first(your_output_key_name4) as your_output_key_name4
 first(key_name1) as key1
 list(key_name2) as key2 
 dc(sourcetype) as dc by id

Problem:
JSon path could vary. Therefore, output variables too. Is there a way in Splunk that these could be discovered dynamically?

Regards,
Lp

Tags (3)
0 Karma

rgcurry
Contributor

Have you considered using the "KV_MODE" parameter in your props.conf for this sourcetype? Check it out at http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextract....

0 Karma

lpolo
Motivator

It could be an option too... I have to test it.

0 Karma

lpolo
Motivator

This query works:

(sourcetype="request")//sourcelog. Key=value pair format.
 OR
(sourcetype="json_response")//source og. json format.
  |spath  //spath command in auto-extract mode. 
  |stats list(*) as * by id //join source log by id.

However, I am not source if it is limited by the way spath is ran without arguments. As documented:

When spath is ran with no path argument, spath runs in "auto-extract" mode, where it finds and extracts all the fields from the first 5000 characters in the input field (which defaults to _raw if another input source isn't specified).
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!