Splunk Search

How to extract data of JSON in one row?

jhonatancuartas
New Member

I have this JSON, and I want extrac the value when the name is "ca-channel" and value when name is "Ca-Request-Id" but this data in one row, for example:

channel   |        requestId
    w          |       000001707ce0ca4c-58e1e56

alt text

0 Karma

maityayan1996
Path Finder

At first you just extract the fields from the json format of logs. Then try to filter the portions .
Please follow link to extract the fields :
https://answers.splunk.com/answers/679950/how-to-extract-fields-if-the-event-is-in-json-form.html

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...