Splunk Search

How to create the proper search to extract all of the fields and their respective field_values from the sample data?

Strangertinz
Path Finder

Hi Splunkers!


Any one able to assist me with a search that I am trying to create below. 

I want to extract some data from multiple json data value fields. I am able to ingest the json data and extract the fields and values correctly.  Sample data below 


{

"key1": "value1",

"key2": "[field1 = field_value1] [field2 = field_value2] [field3 = field_value3] [field4 = field_value4]",

"key3": "value3",

"key4": "[field5 = field_value5] [field6 = field_value6] "
}


I am trying to create the proper search to extract all of the fields and their respective field_values from the sample data above.


Thanks in advance! 

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming this is an accurate representation of your events, try something like this

| rex max_match=0 field=key2 "\[(?<kvpair2>\S+\s=\s[^\]]+)\]"
| rex max_match=0 field=key4 "\[(?<kvpair4>\S+\s=\s[^\]]+)\]"
| eval kvpairs=mvappend(kvpair2, kvpair4)
| mvexpand kvpairs
| rex field=kvpairs "(?<key>\S+)\s=\s(?<value>.+)
| eval {key}=value

View solution in original post

0 Karma

Strangertinz
Path Finder

Awesome! Thanks for assisting with the search! ITWhisperer for president! 

0 Karma

Strangertinz
Path Finder

Thanks for the prompt and excellent response! 

my apologies for not including this earlier... but what if the json data is nested like the example below?

I would still like to extract field and field values 

{

"key1": "value1",

"key2":  { "key2_key1": "key2_key1_value1",
                   "key2_key2": "key2_key2_value2",
                    "key2_key3" : "[field1 = field_value1] [field2 = field_value2] [field3 = field_value3] [field4 = field_value4]" }

}

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| spath
| rex max_match=0 field=key2.key2_key3 "\[(?<kvpairs>\S+\s=\s[^\]]+)\]"
| mvexpand kvpairs
| rex field=kvpairs "(?<key>\S+)\s=\s(?<value>.+)
| eval {key}=value
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming this is an accurate representation of your events, try something like this

| rex max_match=0 field=key2 "\[(?<kvpair2>\S+\s=\s[^\]]+)\]"
| rex max_match=0 field=key4 "\[(?<kvpair4>\S+\s=\s[^\]]+)\]"
| eval kvpairs=mvappend(kvpair2, kvpair4)
| mvexpand kvpairs
| rex field=kvpairs "(?<key>\S+)\s=\s(?<value>.+)
| eval {key}=value
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...