Splunk Search

Could someone help me with parsing JSON to a table?

Roei_Rom
Engager

I have the following JSON object which contains certificates expreation date:

{
        "certificate-one.crt": 2022-11-11T16:00:00.000Z,
        "certificate-two.crt": 2022-11-11T16:00:00.000Z
}

I want to convert it to the following table:

certificate name        |  expiration date
 --------------------------|---------------------------------------
certificate-one.crt    |  2022-11-11T16:00:00.000Z
--------------------------|---------------------------------------
certificate-two.crt    |  2022-11-11T16:00:00.000Z

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "\"(?<certificate_expiry>[^\"]+\"[^\"]+\"[^\"]+)\""
| mvexpand certificate_expiry
| rex field=certificate_expiry "(?<certificate_name>[^\"]+)\"[^\"]+\"(?<expiration>[^\"]+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "\"(?<certificate_expiry>[^\"]+\"[^\"]+\"[^\"]+)\""
| mvexpand certificate_expiry
| rex field=certificate_expiry "(?<certificate_name>[^\"]+)\"[^\"]+\"(?<expiration>[^\"]+)"

Roei_Rom
Engager

Thanks!

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...