Splunk Search

Field-extraction on a JSON message with multiple delimiters?

jayakumar89
Explorer

I have this:

{"date": null, "facility": -1, "host": null, "level": -1, "message": "2017-11-13T03:45:00+0000 monStatsLog, applianceName=xxxxx, tenantName=xxxx, mstatsTimeBlock=1510544700, tenantId=1, vsnId=0, mstatsTotSentOctets=250, mstatsTotRecvdOctets=0, mstatsTotSessDuration=26001, mstatsTotSessCount=1, mstatsType=sdwan-acc-ckt-app-stats, mstatsId=tftp:Controller1:MPLS:1:2, mstatsAttribs=1:3:general-internet:file-server:Unknown", "charset": "UTF-8", "remote_address": "xxxxxxx", "hostname": "xxxxxx"}

I'm trying to parse a json file with entries like above, where the message field has multiple values, which are in turn delimited using comma and =. How can I parse that specific field to extract all the information?

0 Karma

woodcock
Esteemed Legend

Assuming that your JSON is coherent and being processed correctly you should already have a message field so just do this:

| makeresults 
| eval message="2017-11-13T03:45:00+0000 monStatsLog, applianceName=xxxxx, tenantName=xxxx, mstatsTimeBlock=1510544700, tenantId=1, vsnId=0, mstatsTotSentOctets=250, mstatsTotRecvdOctets=0, mstatsTotSessDuration=26001, mstatsTotSessCount=1, mstatsType=sdwan-acc-ckt-app-stats, mstatsId=tftp:Controller1:MPLS:1:2, mstatsAttribs=1:3:general-internet:file-server:Unknown"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rename message AS _raw
| kv

jayakumar89
Explorer

It helped. Thanks!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...