Splunk Search

How can I parse a log containing multiple JSON records?

yk010123
Path Finder

I have the following log: 

 

 

Requests over Threshold found: {"kv":{"top_requests":[{"operation_name":"get","last_dispatch_duration_us":136231,"last_remote_socket":"xx","last_local_id":"67B57F7300000001/00000000C1E2DBA3","last_local_socket":"xxx:37894","total_dispatch_duration_us":136231,"total_server_duration_us":3,"operation_id":"0x127f1","timeout_ms":250,"last_server_duration_us":3,"total_duration_us":136516},{"operation_name":"get","last_dispatch_duration_us":135914,"last_remote_socket":"xxx","last_local_id":"67B57F7300000001/00000000C1E2DBA3","last_local_socket":"xxx:37894","total_dispatch_duration_us":135914,"total_server_duration_us":15,"operation_id":"0x127e9","timeout_ms":250,"last_server_duration_us":15,"total_duration_us":135985},{"operation_name":"get","last_dispatch_duration_us":135827,"last_remote_socket":"xxx.xxx:11210","last_local_id":"67B57F7300000001/000000006A92D90B","last_local_socket":"xxx:59306","total_dispatch_duration_us":135827,"total_server_duration_us":15,"operation_id":"0x127e7","timeout_ms":250,"last_server_duration_us":15,"total_duration_us":135946}],"total_count":3}}

 

 

How can I parse this? 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Depending on what you want - assuming you are just looking at top_requests, you could do something like this

| rex "Requests over Threshold found: (?<json>.*)"
| spath input=json kv.top_requests{} output=top_requests
| mvexpand top_requests
| spath input=top_requests

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Requests over Threshold found: (?<json>.*)"
| spath input=json

yk010123
Path Finder

How can I format this to a table? 

Is this the right approach? 

 

rex "Requests over Threshold found: (?<json>.*)"| spath input=json
| table kv.*
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you are trying to achieve

yk010123
Path Finder

I am trying to show all the fields in a table format so I can sort and analyze them

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Depending on what you want - assuming you are just looking at top_requests, you could do something like this

| rex "Requests over Threshold found: (?<json>.*)"
| spath input=json kv.top_requests{} output=top_requests
| mvexpand top_requests
| spath input=top_requests

yk010123
Path Finder

I would like to show all the fields from the JSON in a table format such that we have field=value

0 Karma

yk010123
Path Finder

If we have multiple entries in the JSON, it should create individual rows

0 Karma

yk010123
Path Finder

Perhaps this? 

 

| spath input=json kv.top_requests{} output=top_requests | mvexpand top_requests
| spath input=top_requests
| table operation_name last_dispatch_duration_us last_remote_socket last_local_id last_local_socket total_dispatch_duration_us total_server_duration_us operation_id timeout_ms last_server_duration_us total_duration_us
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...