How to extract a JSON object which is in double quotes?

[Kukkadapu]

Hi, I've a JSON object logged into splunk in double quotes. What to do to extract the JSON object using spath. How do I ignore the double quotes before doing the spath.

2016-01-20 17:40:38,076 INFO org.apache.log4j.Logger transaction_id="1234565"
Json_object = "{

"requestId": "123",

"partnerId": "asd",

"date":"01/01/2015 14:00:00"

}"
tmepId ="123"

Thanks.

[ohoppe · Accepted solution]

Hi,

here you go. The important bit is the line with the rex command. The rest of it I just used to simulate the event and present the result.

|stats count|eval count="2016-01-20 17:40:38,076 INFO org.apache.log4j.Logger transaction_id=\"1234565\"
Json_object = \"{
\"requestId\": \"123\",
\"partnerId\": \"asd\",
\"date\":\"01/01/2015 14:00:00\"
}\"
tmepId =\"123\""|

rex field=count "(?s)\"(?{.*})\""

|table count myjson|spath input=myjson

BR
Oliver

[Kukkadapu]

Thanks Oliver. That worked:)

[ohoppe]

Very Welcome. 🙂