Splunk Search

Help extracting information from JSON file

UnaBizLeon
New Member

Json Format ↓
{
"device":"A123",
"data":"28745637",
"time":"1505924687",
}

"2874" = 28.74 , means tempurature , and "5637" = 56.37% humidity .

How to display as below↓

if ( tempurature > 25 & humidity >50)
{
display matching data ;
}

0 Karma

UnaBizLeon
New Member

Thanks , My problem has been successfully resolved !!

0 Karma

gokadroid
Motivator
your query to return events
| rex "data\"\:\"(?<temp>\d{4})(?<humid>\d{4})"
| search temp>2500 and humid>5000

If you want the percentages to display then you can add following to above and table the evals.

    | eval temperature=round(temp/100,2)
    | eval humidity=round(humid/100, 2)
   | table temperature, humidity
0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

In transforms.conf (to extract temperature and humidity fields)

REGEX = "data":"(?P<temperature>\d{4})(?P<humidity>\d{4})

You can than do an eval like the following:
| eval temp=round(temperature/100, 2)

I'll keep poking around to see how to insert a decimal into the field, but not sure how to do that right now:)

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@sshelly - something like this should work. I don't believe the . needs escaped in the format.

[temp]
 REGEX = "data":"(\d{2})(\d{2}) 
 DEST_KEY = temperature
 FORMAT = \1.\2

[humid]
 REGEX = "data":"\d{4}(\d{2})(\d{2}) 
 DEST_KEY = humidity
 FORMAT = \1.\2
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...