Splunk Search

How to create table columns from JSON?

kackerman7
Observer

Hi, I have fields from a JSON file that are getting parsed like this: 

kackerman7_0-1655917639143.png

I'm struggling to find a way to turn those fields into columns in a table. Anyone have any experience with this? 

 

Thank you

 

Labels (2)
0 Karma

rymundo_splunk
Splunk Employee
Splunk Employee

Hi, would something like this work for you?

|makeresults
| eval json="{\"Packets\":{\"0\": 4, \"1\": 3}, \"Bytes\":{\"0\":8, \"1\":42} }"
| spath input=json
| table Packets.* Bytes.*

Basically I take the string, parse it to json, then I can use dot notation and wildcards to extract the key names to be column names.

rymundo_splunk_1-1655945627642.png

 

0 Karma

kackerman7
Observer

Hi, 

Unfortunately no - I've tried something similar to this. I need all of the Packets elements in one column, all of the Bytes elements in another column, etc. 

0 Karma

rymundo_splunk
Splunk Employee
Splunk Employee

Okay, I misunderstood.  I think you are asking for something like this?

Index Packet Bytes
0 1 10
1 4 40
2 2 20

 

|makeresults
| eval json="{\"Packets\":{\"0\": 4, \"1\": 3}, \"Bytes\":{\"0\":8, \"1\":42} }"
| spath input=json
| table Packets.* Bytes.*
| eval indexes=null(),
packets=null(),
bytes=null()
| foreach Packets.* [ eval indexes=mvappend(indexes,"<<MATCHSEG1>>"), packets=mvappend(packets,'<<FIELD>>') ]
| foreach Bytes.* [ eval bytes=mvappend(bytes,'<<FIELD>>') ]
| eval i_p_b=mvzip(mvzip(indexes, packets), bytes)
| fields i_p_b
| mvexpand i_p_b
| rex field=i_p_b "^(?<index>\d+),(?<packet>\d+),(?<bytes>\d+)"

 

rymundo_splunk_0-1656017027850.png

 

0 Karma

kackerman7
Observer

Yes, this is exactly what I'm looking for. However, when I run it on my data (with all fields included), my table is empty. What am I doing wrong? 

kackerman7_0-1656359174452.png

 

kackerman7_1-1656359248343.png

 

 

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...