Extract JSON fields in mixed data structure with props

[_smp_]

I have an event with a mix of JSON and non-JSON data. I have successfully extracted a Payload field with props whose value is a JSON data structure. Then using the search | spath input=Payload, the value is successfully parsed into KV pairs. But how do I move this to a config file for automatic extraction? I was looking at an EVAL- statement with the spath() function, but it's not clear what the "Y" value should be if I want to extract all of the fields, not just a specific one:

EVAL-Payload = spath(Payload, "*")

[koshyk]

Please see similar question and answer
https://answers.splunk.com/answers/117121/extract-json-data-within-the-logs-json-mixed-with.html

[faguilar]

Hi @scottprigge
I have the same issue here with a JSON payload, but I couldn't figure out how to extract the data on the JSON field to make the data search. Can you show me how you manage to get the data of the JSON payload within the props?

one of my events:

05/18/2019 00:00:00 +0200, info_search_time=1558442780.272, application=axo, createDate="01/01/2019", description=mydesc, id=123456789, results="{\"results\":{\"myDate\":\"27/04/2019\",\"myId\":\"3215AAA_24369\",\"myClientId\":\"12345\",\"myType\":\"Total\"}}"

My props.conf for this sourcetype:

[extract_json]
REGEX = \"(?<field>[^\"]+)\":\"(?<value>[^\"]+)
FORMAT= "$1"::"$2"
WRITE_META = true

I couldn't make this thing work.

Thank you!!

[koshyk]

@faguilar , please find the similar post below

[faguilar]

Thank you @koshyk!!! Sorry I didn't saw the answer

[koshyk]

no probs. if it has helped you, please upvote/accept. cheers