Splunk Search

How to extract key-value pair from json object?

itnewbie
Explorer

I have a JSON event like this: 

 

 

{
...otherfields...,
"fields": {
  "id1": 123,
  "id2": 456,
  "id3": 789,
...
},
...otherfields...
}

 

 

 I want to extract some key-value pairs from the "fields" object, i.e., I want to see the extracted fields in the "interesting fields" section.

For example, if I only want to extract id1 and id3, I should use 

 

 

eval new_id1 = mvindex(fields.id1, 0)
eval new_id3 = mvindex(fields.id3, 0)

 

 

 , right? Or is there another efficient way but not to use Foreach? I am new to the Splunk syntax so would appreciate any help. 

Labels (1)
Tags (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

mvindex wouldn't do anything to single valued fields.id1, fields.id3, etc.  To limit fields of interest, use fields command.

| fields fields.id1 fields.id3

If you only want to display these fields in statistics tab, use table command.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| spath fields.id1 output="new_id1"
| spath fields.id3 output="new_id3"

N.B. The spath command is built for extracting fields from JSON (and XML) structured data.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...