Splunk Search

How to extract Json object as field?

karthi2809
Builder

Hi ,

How to extract the fields from below json logs.

Here we have fields like content.jobname and content.region .But i need to extract  content.payload details.how to extract the value.

 

 

"content" : {
    "jobName" : "PAY",
    "region" : "NZ",
    "payload" : [ {
      "Aresults" : [ {
        "count" : "6",
        "errorMessage" : null,
        "filename" : "9550044.csv"
      } ]
    }, {
      "Bresults" : [ {
        "count" : "6",
        "errorMessage" : null,
        "filename" : "9550044.csv"
      } ]
    } ]
  }

 

 

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi 

As @richgalloway said, have you look command spath?

There are quite many old answers where are asked quite similar questions. Just use google/bing or what ever to find those.

r. Ismo

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?  Did you try the spath command?

---
If this reply helps you, Karma would be appreciated.
0 Karma

karthi2809
Builder

Yes i tried but in my case need to extract whole content.payload as one field.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first step is to make sure the data is valid JSON because the spath command will not work with invalid JSON.  jsonlint.com rejected the sample object.

Here is a run-anywhere example that extracts payload as a single field.

| makeresults format=json data="[{\"content\" : {
    \"jobName\" : \"PAY\",
    \"region\" : \"NZ\",
    \"payload\" : [ {
      \"Aresults\" : [ {
        \"count\" : \"6\",
        \"errorMessage\" : null,
        \"filename\" : \"9550044.csv\"
      } ]
    }, {
      \"Bresults\" : [ {
        \"count\" : \"6\",
        \"errorMessage\" : null,
        \"filename\" : \"9550044.csv\"
      } ]
    } ]
  }}
  ]"
| spath output=payload content.payload{}
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...