Splunk Search

How to convert multiple individual json objects into a nested json object ?

damode1
Path Finder

I want to convert some of the below individual json objects in the event into nested single json object like the second example

Current Format

{
    "ID": 1,
    "Timestamp": "2023-05-18T05:07:59.940594300Z",
    "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)",
    "Company": "Microsoft Corporation",
    "TerminalSessionId": 0,
    "UtcTime": "2018-08-20 15:18:59.929",
    "Product": "Microsoft® Windows® Operating System",
}

Expected Format

{
    "ID": 1,
    "Timestamp": "2023-05-18T05:07:59.940594300Z",
    "EventData":{
        "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)",
        "Company": "Microsoft Corporation",
        "TerminalSessionId": 0,
        "UtcTime": "2018-08-20 15:18:59.929",
        "Product": "Microsoft® Windows® Operating System",
    }
}


I have tried to playaround with json functions but unable to figure out how to achieve the above outcome.

Can someone please help ?

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

This seems to be the exact question as How to convert multiple individual json objects into a nested json object in an event ? You can checkout answer there.  But I'm curious: why the interest all in a sudden?  This doesn't seem to be a very practical use of Splunk.  Such tasks can be more easily accomplished outside of SPL.

0 Karma

damode1
Path Finder

ya sorry about that. my original post was repeatedly getting tagged as spam post for some unknown reason, hence, unfortunately I had to post it from another account.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...