Splunk Search

How to extract a field from nested data in a search?

sanchitlohia
Explorer

I have events in splunk like this

code=123 name="somename1"  data={ _id = "someid1"}
code=123 name="somename2"  data={ _id = "someid2"}

I wanted to search on the base of code and _id and my query is like this

code=123 _id="someid1"

But this query does not give me any result probably because _id is nested under data. How to write the query so that I can get the result in correct format.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi sanchitlohia,

you could search for this: code=123 data="{ _id=*"

I would suggest that you extract the id as new field like this:

code=123 | rex field=data "\_id\s\=\s\"(?<my_id>[\w\d]+)\"" | table my_id

if this helps, you can setup search time field extraction http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Addfieldsatsearchtime to get this id field in all searches

hope this helps to get you started ...

cheers, MuS

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...