Splunk Search

How can I extract ALL occurrences of a field from JSON file?

Sanjay71
New Member

23.10.2017 14:01:23.745 INFO [10.87.80.251 [1508785283744] POST /apps/globallog HTTP/1.1] InfoLoggerServiceImpl {"id":{"field1":"DDDDDDD","field2":"XXXXXX","field3":"XXXXXXX","field4":"BBBBBB"},"request":{"url":"https://CCCCC-detail.html","timestamp":"2017.10.23 14:01:23.745"},"info":{"api":[{"NAME":"API1","CORRELATIONID":" VVVV","URL":"API1.json"},{"NAME":"API2","CORRELATIONID":" VVVV ","URL":"API2.json"}]}}

Was able to extract the fields as Name/Values pairs; but only the first occurrence is extracted ie. API2 is not getting extracted
From the above ONLY API1 was extractable but not "NAME":"API2","CORRELATIONID":" VVVV ","URL":"API2.json, I was assuming the below would have shown 2 URLs, 2 Names, 2 Correlation ID

URL is calling 2 APIs and only one of them seems is extracted by the below syntax

This was used to extract the name/value pairs
[json_embedded]
REGEX = "(\w+)"."(\S+?)"
FORMAT = $1::$2

Appreciate any help

0 Karma

somesoni2
Revered Legend

Use this for your transforms.conf entry

[json_embedded]
REGEX = "(\w+)"."(\S+?)"
FORMAT = $1::$2
REPEAT_MATCH = true
MV_ADD = true

Reference: https://answers.splunk.com/answers/484037/multi-value-field-extraction-propsconf-transformsc.html

0 Karma

Sanjay71
New Member

23.10.2017 14:01:23.745 INFO [10.87.80.251 [1508785283744] POST /apps/globallog HTTP/1.1] InfoLoggerServiceImpl {"id":{"field1":"DDDDDDD","field2":"XXXXXX","field3":"XXXXXXX","field4":"BBBBBB"},"request":{"url":"https://CCCCC-detail.html","timestamp":"2017.10.23 14:01:23.745"},"info":{"api":[{"NAME":"API1","CORRELATIONID":" VVVV","URL":"API1.json"},{"NAME":"API2","CORRELATIONID":" VVVV ","URL":"API2.json"}]}}

Was able to extract the fields as Name/Values pairs; but only the first occurrence is extracted ie. API2 is not getting extracted
From the above ONLY API1 was extractable but not "NAME":"API2","CORRELATIONID":" VVVV ","URL":"API2.json, I was assuming the below would have shown 2 URLs, 2 Names, 2 Correlation ID

URL is calling 2 APIs and only one of them seems is extracted by the below syntax

This was used to extract the name/value pairs
[json_embedded]
REGEX = "(\w+)"."(\S+?)"
FORMAT = $1::$2

Appreciate any help

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @Sanjay71, can you review your post and "XXX" out any sensitive fields? Answers is a public forum, so anyone can see this post by searching online. Specifically field 1 and 3 stood out.

0 Karma

Sanjay71
New Member

Hi @lfedak - any thoughts on my question? Thanks

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...