Splunk Search

Failed to parse a JSON string

erwanlebaron
Engager

Hi

 

I get data from an CSV file and one of the filed imported is a JSON string called "Tags" which looks like that

Tags = {"tag1": "toto" "tag2": "tata" "tag4": "titi"}  --> exemple for a line
Tags = {"tag3": "toto" "tag4": "tata"}  --> exemple for another line

 

The delimitation between key and value is <colon>+<space>
The delimitation between two key+value is <space>

 

I tried 

 

 

| spath input=Tags

 

 

but when I do

 

 

| table tag1, tag2, tag3, tag4

 

 

I get value only for tag1.

 

I tried to find a way to solve it by looking other topics but I do not succed.

I understood that my string is not correctly formatted like a "real" Json but I don't fin the command to convert my initialy field "Tags" into a correct Json format to apply the "spath" command

 

Is there anybody has an idea to do it

 

Thanks in adance

Labels (1)
Tags (3)
0 Karma

erwanlebaron
Engager

It works by doing that before the spath command

 

| eval Tags_json=replace(Tags,": ",":")
| eval Tags_json=replace(Tags_json,"\" \"","\",\"")

 

But it doesn't look very elegant...

 

There is a better solution ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...