Splunk Search

Extract part of JSON object with its child or nested attributes

imprabha1989
New Member

Hi All,

Our data ingested into our Index are in proper JSON format & Splunk is converting into JSON object automatically  , but I'm unable to extract/access any of  the child object along with its nested attributes.

Example :

{
"name": "notificationService",
"requestId": "ee76e5cf-90cc-521f-bc96-bdf6f39f5bc8",
"parsedEvent": {
                "event": {
                                    "eventName": "Notification",
                                    "timestamp": "2020-11-26T18:55:14.000+11:00",
                                    "delivery": "NotifierSystem",
                                    "notificationEventType": "EMAIL"
                              },
 "metadata": {
                    "correlationId": "1603246877854"
                       }
},
"msg": "Starting to process event",
"time": "2020-11-26T08:02:39.123Z"
}

 

Search query :    .... | table  requestId, name, parsedEvent.metadata.correlationId, parsedEvent.event

Is getting me :

ee76e5cf-90cc-521f-bc96-bdf6f39f5bc8,notificationService, 1603246877854,<blank>

If you see, I'm not able to get the  "parsedEvent.event" object along with its child attributes, but i'm able to access "parsedEvent.metadata.correlationId"   successfully which doesn't have any child.

 Any help would be appreciated. 

Thanks in Advance.

 

Labels (1)
0 Karma

to4kawa
Ultra Champion

 

index=_internal | head 1 | fields _raw | eval _raw="{\"name\":\"notificationService\",\"requestId\":\"ee76e5cf-90cc-521f-bc96-bdf6f39f5bc8\",\"parsedEvent\":{\"event\":{\"eventName\":\"Notification\",\"timestamp\":\"2020-11-26T18:55:14.000+11:00\",\"delivery\":\"NotifierSystem\",\"notificationEventType\":\"EMAIL\"},\"metadata\":{\"correlationId\":\"1603246877854\"}},\"msg\":\"Starting to process event\",\"time\":\"2020-11-26T08:02:39.123Z\"}"
| spath parsedEvent output=parsedEvent
| spath input=parsedEvent event output=nest_event
| spath input=parsedEvent metadata output=nest_metadata

 

Splunk deploys everything, so you'll have to do it yourself to put it together

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for getting the eventName? That is, has the full extraction worked down to the lowest level?

 table  requestId, name, parsedEvent.metadata.correlationId, parsedEvent.event.eventName
0 Karma

imprabha1989
New Member

@ITWhisperer 

Yes, the full extraction to the lowest level is/are working. But it I want the whole event object with its nested attributes.  We can use rex operation on _raw data but looking for something that can help us easily access it as we normally do with in JSON objects or something that converts pointed JSON object  to a string.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Reparse _raw for the object you want

| spath path=parsedEvent.event
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...