Splunk Search

How to convert multiple individual json objects into a nested json object in an event ?

dm1
Contributor

I want to convert some of the below individual json objects in the event into nested single json object like the second example

Current Format

{
    "ID": 1,
    "Timestamp": "2023-05-18T05:07:59.940594300Z",
    "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)",
    "Company": "Microsoft Corporation",
    "TerminalSessionId": 0,
    "UtcTime": "2018-08-20 15:18:59.929",
    "Product": "Microsoft® Windows® Operating System",
}

Expected Format

{
    "ID": 1,
    "Timestamp": "2023-05-18T05:07:59.940594300Z",
    "EventData":{
        "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)",
        "Company": "Microsoft Corporation",
        "TerminalSessionId": 0,
        "UtcTime": "2018-08-20 15:18:59.929",
        "Product": "Microsoft® Windows® Operating System",
    }

}


I have tried to playaround with json functions but unable to figure out how to achieve the above outcome.

Can someone please help ?

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

If you are on Splunk 8 or later, you can use json_object to compose a new object.

| eval json = json_object("ID", ID, "Timestamp", Timestamp, "EventData", json_object("FileVersion", FileVersion, "Company", Company, "TerminalSessionId", TerminalSessionId, "UtcTime", UtcTime, "Product", Product))

 

Tags (1)
0 Karma

damode1
Path Finder

Apologies. I realised  my understanding of the data was incorrect.

I have put the requirement and current data format on this new post

https://community.splunk.com/t5/Splunk-Search/How-to-convert-nested-xml-block-into-json-formatted-ne...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...