Splunk Search

How to extract json fields from json inside single quotes?

Alanshiau717
New Member

Hey I am having difficulties trying to extract fields from my splint logs. They are in the format of

’{“field”: “value1”, “field2”: “value2”}’  I’ve tried using spath but it doesn’t seem to work. I think the issue is that the json object is enclosed in single quotes so splunk doesn’t recognise it as json. 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

One solution is to rex the json out.  Assuming that the sample data you give is _raw:

| rex "'(?<jfield>[^']+)"
| spath input=jfield

 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...