Splunk Search

Could someone help me with parsing JSON to a table?

Roei_Rom
Engager

I have the following JSON object which contains certificates expreation date:

{
        "certificate-one.crt": 2022-11-11T16:00:00.000Z,
        "certificate-two.crt": 2022-11-11T16:00:00.000Z
}

I want to convert it to the following table:

certificate name        |  expiration date
 --------------------------|---------------------------------------
certificate-one.crt    |  2022-11-11T16:00:00.000Z
--------------------------|---------------------------------------
certificate-two.crt    |  2022-11-11T16:00:00.000Z

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "\"(?<certificate_expiry>[^\"]+\"[^\"]+\"[^\"]+)\""
| mvexpand certificate_expiry
| rex field=certificate_expiry "(?<certificate_name>[^\"]+)\"[^\"]+\"(?<expiration>[^\"]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "\"(?<certificate_expiry>[^\"]+\"[^\"]+\"[^\"]+)\""
| mvexpand certificate_expiry
| rex field=certificate_expiry "(?<certificate_name>[^\"]+)\"[^\"]+\"(?<expiration>[^\"]+)"

Roei_Rom
Engager

Thanks!

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...