Splunk Search

Failed to parse a JSON string

erwanlebaron
Engager

Hi

 

I get data from an CSV file and one of the filed imported is a JSON string called "Tags" which looks like that

Tags = {"tag1": "toto" "tag2": "tata" "tag4": "titi"}  --> exemple for a line
Tags = {"tag3": "toto" "tag4": "tata"}  --> exemple for another line

 

The delimitation between key and value is <colon>+<space>
The delimitation between two key+value is <space>

 

I tried 

 

 

| spath input=Tags

 

 

but when I do

 

 

| table tag1, tag2, tag3, tag4

 

 

I get value only for tag1.

 

I tried to find a way to solve it by looking other topics but I do not succed.

I understood that my string is not correctly formatted like a "real" Json but I don't fin the command to convert my initialy field "Tags" into a correct Json format to apply the "spath" command

 

Is there anybody has an idea to do it

 

Thanks in adance

Labels (1)
Tags (3)
0 Karma

erwanlebaron
Engager

It works by doing that before the spath command

 

| eval Tags_json=replace(Tags,": ",":")
| eval Tags_json=replace(Tags_json,"\" \"","\",\"")

 

But it doesn't look very elegant...

 

There is a better solution ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...