Splunk Search

Convert JSON to table

splunk_skr
Explorer

I tried looking up for a solution and went through almost all suggestions. None worked for me. I have the following json log that i want to convert to table. This is the raw representation for the json.

{"timestamp": "2017-05-28T19:34:15.698Z",
    "F_A": "valuefor_F_A",
    "F_B": "valuefor_F_B",
    "F_C": "{\"x\":\"valuefor_x\",\"y\":\"valuefor_y\",\"z\":\"valuefor_z\"}",
    "F_D": "valuefor_F_D"
}

Field F_C contains most of the info which i want to see in a table. I also need the timestamp in the table. So basically here is what i am looking for

x                   y                             z                  timestamp
=====================================================================
valuefor_x         valuefor_y       valuefor_z         2017-05-28T19:34:15.698Z

Any suggestions?

0 Karma

jkat54
SplunkTrust
SplunkTrust

The timestamp should be auto recognized:

Here's my "down and dirty, cell phone typed answer":

 ... | rex 'x\\":\\"(?<x>.+)\\",\\"y\\":\\"(?<y>.+)\\",\\"z\\":\\"(?<z>.+)\\"}"' | table x y z _time
0 Karma

splunk_skr
Explorer

Thanks,,there are syntactical errors..trying to fix now.

0 Karma

splunk_skr
Explorer

Unable to make it work. any other suggestions?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Change the double slashes to triple slashes, if that don't work make them quad slashes. Sorry I couldn't test first, but I'm far away from my computer.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...