Splunk Search

How to extract a key value pair, convert it to a JSON format and assign it to a variable using eval?

nibinabr
Communicator

Hi Guys,

I have a log event like the following

2015-01-08T08:56:30.835Z "Name:John"="21","Name:Sam"="29","Name:Jim"="40"

.....(not just three)

How do I extract the Name and the corresponding number and convert it in to a JSON format like the one below.
{John:21,Sam:29,Jim:40}

I can extract the name and the number, but what I'm not sure about is how I can change it to the JSON format above.

NB: I need to assign this json formatted string to a variable using eval.
eval new_var=[search that generate the JSON formatted string]

0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

What exactly are you going to use new_var for because you can export extracted name and number fields directly from the UI as JSON?

A hacky way to convert the entire quoted string of names and numbers into JSON is to essentially extract it wholesale and apply several rex commands to shape it into the correct form:

Field test: "Name:John"="21","Name:Sam"="29","Name:Jim"="40"
Search: | rex field=test mode=sed "s/(\"Name:)|(\")//g" | rex field=test mode=sed "s/=/:/g" | rex field=test mode=sed "s/^/{/" | rex field=test mode=sed "s/$/}/g"

Full example:

| stats count | eval test="\"Name:John\"=\"21\",\"Name:Sam\"=\"29\",\"Name:Jim\"=\"40\"" | rex field=test  mode=sed "s/(\"Name:)|(\")//g" | rex field=test  mode=sed "s/=/:/g" | rex field=test  mode=sed "s/^/{/" | rex field=test  mode=sed "s/$/}/g"

Output:

{John:21,Sam:29,Jim:40} 

View solution in original post

_d_
Splunk Employee
Splunk Employee

What exactly are you going to use new_var for because you can export extracted name and number fields directly from the UI as JSON?

A hacky way to convert the entire quoted string of names and numbers into JSON is to essentially extract it wholesale and apply several rex commands to shape it into the correct form:

Field test: "Name:John"="21","Name:Sam"="29","Name:Jim"="40"
Search: | rex field=test mode=sed "s/(\"Name:)|(\")//g" | rex field=test mode=sed "s/=/:/g" | rex field=test mode=sed "s/^/{/" | rex field=test mode=sed "s/$/}/g"

Full example:

| stats count | eval test="\"Name:John\"=\"21\",\"Name:Sam\"=\"29\",\"Name:Jim\"=\"40\"" | rex field=test  mode=sed "s/(\"Name:)|(\")//g" | rex field=test  mode=sed "s/=/:/g" | rex field=test  mode=sed "s/^/{/" | rex field=test  mode=sed "s/$/}/g"

Output:

{John:21,Sam:29,Jim:40} 

nibinabr
Communicator

Your solution solved my problem. But please do let know if you have a better way to get this done.

0 Karma

nibinabr
Communicator

I'm using a splunk app which has a variable that accepts some data in the form of a JSON object (eval app_variable=new_var). What I was trying to do is to convert the data in to a JSON format. Please let me know if you have a better way to do this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...