Splunk Search

How do I extract all fields from userdata?

siksaw33
Path Finder

How do I extract all fields from userdata?

 

 accept=application/json, timestamp=1651243086870} OutboundWebHookPayload={"clientType":"Client","mediaType":"ask","subject":"EscapeClient","userData":{"country":"UK","lastName":"ELMER","agentId":"7060856","conversationId":"conv_1d55ec01e970c8833e8b8206be287fce","sessionId":"itc_58f7ad65-fcb0-46bd-81-1717f84dd7","chatSessionId":"s_eaf99b35-59fd-4d36-8f8f-c6423f8ec610","locale":"en-GB","languageCode":"en","experience":"Default","publicGuid":"1d55ec01e970c8833e8b8206be287fce","accountNumber":"XXXXXXXXXXXXXXX","firstName":"LUKE","environment":"prod","intentCode":"statement_balance","upfrontRoutingIntent":"CardServices","InteractionType":"Resume","customerId":"508558871407","channelName":"MApp","ProductType":" Card"}}

 

 

I tried

 

userData | rex field=_raw "userData.:{.IACode.:.(?<IACode>[A-Za-f0-9]+).,.country.*upfrontRoutingIntent.:.(?<upfrontRoutingIntent>[^\"]+).," | table IACode upfrontRoutingIntent

 

But I need other fields like Experience and Product type as well

 

Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "OutboundWebHookPayload=(?<json>\{.*\})"
| spath input=json userData output=userData
| spath input=userData

View solution in original post

0 Karma

siksaw33
Path Finder

ahh.. n00b mistake by me. @ITWhisperer  you are correct. This worked, you are the best. Thanks a ton!

0 Karma

siksaw33
Path Finder

I dont get anyJSON string, I  get what I was getting earlier. No changes. I get 1500 events in the below format.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Here is a runanywhere example showing the extraction

| makeresults 
| eval _raw="02 May 2022 11:20:42,825 log_level='DEBUG' thread_name='https-jsse-nio-8443-exec-2999' environment=e3_ipc1 hostName=operator-a-deployment-42-kn9ph class_name='com.wsgcat.ngsp.logan.logger.LoganOperatorOutboundWebhookLogging' app=NGSPLOGAN event_name=LOGANOPERATOR logancorrelationId=fZFtvmmb-02052022-112040911 channel name=bean 'createRequestWithHeaderChannel' LoganOperatorOutboundWebhookLogging Info - OutboundWebHookHeaders={Authorization=Bearer eyJraWQiOiJyc2FLZXlVTklWIiwiYWxnIjoiUlM1MTIifQ.eyJzY3AiOlsiZnVuY3Rpb246XC9DcmVhdGVNZXNzYWdpbmdJbnRlcmFjdGlvbi52MSJdLCJzdWIiOiIzNWIyODNjNi01NTBhLTNiNTctYmZiMC1iY2I1N2Y3ZDRlYzEiLCJ2ZXIiOiIxLjAiLCJpc3MiOiJBbWV4SURhYVNJRCIsInR5cCI6ImFwcCIsImV4cCI6MTY1MTUxNTk2MCwianRpIjoiMjcyNjZmOTMtMTAzZi00M2FkLWE2ZDQtM2M2OGExNmVjNmFkIn0.X2HAnLvITD9ri/YVbyxCQyJcYjDmThYWOkHgz5yW3OaSmvAIscZA3O7tE6uE1c6aUyjOS+O3Qw6lHpSSG7D+5tp6whJb3Qa7eqiBY0hP4+iI8GYiRPXb2vZbFKLDPYQ4eVOPPJ0lZ3wh1Poqy5s+duZmVH7mx4rXwc+i6TL7S80OiI6LajCfuLE4swnq2n+zfFF2mWzK8DAr93vOlUkRB5eHWleGAYsng7bbC+KdDMqo06aZJDnfa2R/dxRdrhBwZrKMaWAqOLMrjmjgDrj2dMo0/UKsXKHdM83BIlPKCn+gJWjHG3D0ZEXwljrGTgm9YMBG8ZON4ieE05JPbsiI0w==, replyChannel=org.springframework.messaging.core.Template$TemporaryReplyChannel@6365782d, errorChannel=org.springframework.messaging.core.Template$TemporaryReplyChannel@6365782d, one-correlation-id=conv_cb44295ae5e9870f28ee1-02022-1121911, id=8997e7f6-59fa-ba5a-206c-0e7bfbf149c8, Content-Type=application/json, accept=application/json, timestamp=1651515642824} OutboundWebHookPayload={\"clientType\":\"Client\",\"mediaType\":\"ask\",\"subject\":\"AskEscapeClient\",\"userData\":{\"country\":\"US\",\"lastName\":\"DURFEE\",\"agentId\":\"6438\",\"conversationId\":\"conv_cb442617aae5e9870f28ee1\",\"sessionId\":\"itc_830e-bc73-a25aa95c6136\",\"chSessionId\":\"s_7c33b596- -816d21874c5e\",\"locale\":\"en-US\",\"languageCode\":\"en\",\"experience\":\"Pl\",\"publicGuid\":\"cb44295c401145617aae5e9870f28ee1\",\"accountNumber\":\"XXXXXXXXXXXXXXX\",\"firstName\":\"JO\",\"environment\":\"prod\",\"intentCode\":\"travel\",\"upfrontRoutingIntent\":\" travel\",\"InteractionType\":\"Resume\",\"customerId\":\"284745861019\",\"channelName\":\"MA\",\"ProductType\":\"Pla\"}}"
| rex "OutboundWebHookPayload=(?<json>\{.*\})"
| spath input=json userData output=userData
| spath input=userData
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "OutboundWebHookPayload=(?<json>\{.*\})"
| spath input=json userData output=userData
| spath input=userData
0 Karma

siksaw33
Path Finder

Sorry @ITWhisperer  this did not work. Maybe I am doing something wrong. But this is not converting and  returning the userdata package to a table format.


userData | rex "OutboundWebHookPayload=(?<json>\{.*\})"
| spath input=json userData output=userData
| spath input=userData

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK So what are you getting?

0 Karma

siksaw33
Path Finder

Nothing @ITWhisperer I just get the events that I was getting earlier. No regex parsing. Could you please double check? 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this at least return the json string?

| rex "OutboundWebHookPayload=(?<json>\{.*\})"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...