Splunk Search

How do I perform field extraction and index the data contained in the one detail field which is json within json?

jet
Explorer

I have a modular input to write to Splunk using

event = Event()

event.data = json.dumps(data)

ew.write_event(event)

This all works fine except that in some event.data records there is a detail field that also contains data in json format which is written to Splunk as a string.

How do I perform field extraction and index the data contained in the one detail field which is json within json?

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

As I often remind people, it is much easier for others to help if they can see sample data.

The answer to your question really depends on how the JSON string is escaped.  In the simplest situation, spath is sufficient.  In the following example, field c is already conformant.

 

| spath input=c

 

_rawa b ci1i2
{"a":1,"b":2,"c":"{\"i1\":4,\"i2\":5}"}12{"i1":4,"i2":5}45
Tags (1)
0 Karma

jet
Explorer

Thanks!

In the attached simple example, the detail field contains json which ideally I would like indexed....

Screen Shot 2022-08-17 at 10.15.18 PM.png

0 Karma

yuanliu
SplunkTrust
SplunkTrust

All you need is to replace input=c with input=detail in my sample code, i.e.,

| spath input=detail

jet
Explorer
Spoiler
Awesome! Is there anyway to set that as a default from a modular input?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

By modular input you mean a sourcetype and such?  No.  (Maybe you can submit as an idea at ideas.splunk.com.  There was another very recent question of a similar nature.)

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...