Field extraction on a delimited file

[rubinod]

Hi,

I would like to assign fields to a delimited text file which does not contain a header.

Lets say an event or row of data looks like the following for a given source:

2343242| 234234cvf32:2345:5656556:-2000|abc-1|DOP|selected|list|{"anid":0,"vid":0,"name":"aname"}|04-03-2013|xyz

As you can see one of the values in the pipe delimited row is JSON, I would like to be able to refer to this data as a specific field and parse it as JSON.

What would be the best approach for this in Splunk?

Regards
D

[kristian_kolb]

This can be done I believe with the use of TRANSFORMS

First look at the REPORT directive from props.conf, which maps to a stanza in transforms.conf.

props.conf

[your sourcetype]
REPORT-blah = delim_split, json_split

transforms.conf

[delim_split]
DELIMS = "|{}"
FIELDS = your list of fields, one of them will contain the JSON string

[json_split]
DELIMS = ",",":"

Something like that should work. Sort of. Look at the docs.

/K

/K