Splunk Search

How to extract fields from JSON data in Splunk?

kotig
Path Finder

Hi

We have the below data, out of which I wanted to extract specific data from the json format.

06/Feb/2016:16:10:06.501 [bd5d5700]        
 {
"success":
{
"success_code":"200",
"request path":"/testedata",
"correlation ID":"Id-5teata"
        }
}
1 Solution

javiergn
SplunkTrust
SplunkTrust

Take a look at the spath command, it will do that for you automatically:

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/spath

View solution in original post

rodneyjerome
Explorer
0 Karma

javiergn
SplunkTrust
SplunkTrust

Take a look at the spath command, it will do that for you automatically:

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/spath

kotig
Path Finder

We have tried to do using the spath, but I did not get the expected response as our log files are not json totally. Those are text log files which contains the json objects in middle somewhere.. please let me know if there is another way where we can extract the json object.

0 Karma

javiergn
SplunkTrust
SplunkTrust

If you have already extracted your fields then simply pass the relevant JSON field to spath like this:

| spath input=YOURFIELDNAME

If you haven't manage to extract the JSON field just yet and your events look like the one you posted above, then try the following:

yoursearch
| rex field=_raw "(?msi)(?<json_field>\{.+\}$)"
| spath input=json_field

That will just extract just the json bits from your event.

0 Karma

dijikul
Communicator

This is good if you're typing manual search results, but is it possible to auto-extract KV's from JSON once you've cleanly extracted the JSON into it's own field?

The raw events aren't ONLY JSON, and I want auto-extractions to occur against a particular field in all search cases, not only those with the spath command piped.

Am I dreaming?

0 Karma

newbie2tech
Communicator

thank you javiergn...your second search worked for my scenario..been trying since few hours ...

0 Karma

kotig
Path Finder

Thanks that helped.. that is what I was looking for. Thank you for a quick reply.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...