I have recently started using json log lines which works great with Splunk. There is one issue, however, which I cannot resolve at the moment.
The idea is to construct the original request out of json object
I have a field with structure:
req.args.paramA = value1
req.args.paramB = value2
req.args.paramC = value3
What I want to have in the end is a string:
By design, I don't know param real names. Those can be changed, depending on what user submitted.
I tried using (as a test):
eval params= ""| foreach req.args.* [eval params=params + <>]
Gave me only Splunk errors...
Give this a try
your current search | eval params="" | foreach req.args.* [eval params=params."<<FIELD>>=".'<<FIELD>>'."&" ]
Thanks. As i wrote i tried it, and it did not work. The problem was with wrong types. Had to use casting tostring
foreach req.args.* [eval params=params."<<FIELD>>=".tostring('<<FIELD>>')."&"]
Now i seems to almost get what i want. The problem is that keys now have full name and some params appear as null if those are missing on other events:
You can use fillnull command to update those null values to something default. like this
your current search | eval params="" | fillnull value="NA" req.args.* | foreach req.args.* [eval params=params."<<FIELD>>=".tostring('<<FIELD>>')."&"]