Splunk Search

How do I perform field extraction and index the data contained in the one detail field which is json within json?

jet
Explorer

I have a modular input to write to Splunk using

event = Event()

event.data = json.dumps(data)

ew.write_event(event)

This all works fine except that in some event.data records there is a detail field that also contains data in json format which is written to Splunk as a string.

How do I perform field extraction and index the data contained in the one detail field which is json within json?

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

As I often remind people, it is much easier for others to help if they can see sample data.

The answer to your question really depends on how the JSON string is escaped.  In the simplest situation, spath is sufficient.  In the following example, field c is already conformant.

 

| spath input=c

 

_rawa b ci1i2
{"a":1,"b":2,"c":"{\"i1\":4,\"i2\":5}"}12{"i1":4,"i2":5}45
Tags (1)
0 Karma

jet
Explorer

Thanks!

In the attached simple example, the detail field contains json which ideally I would like indexed....

Screen Shot 2022-08-17 at 10.15.18 PM.png

0 Karma

yuanliu
SplunkTrust
SplunkTrust

All you need is to replace input=c with input=detail in my sample code, i.e.,

| spath input=detail

jet
Explorer
Spoiler
Awesome! Is there anyway to set that as a default from a modular input?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

By modular input you mean a sourcetype and such?  No.  (Maybe you can submit as an idea at ideas.splunk.com.  There was another very recent question of a similar nature.)

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...