Splunk Search

How to extract key-value pair from json object?

itnewbie
Explorer

I have a JSON event like this: 

 

 

{
...otherfields...,
"fields": {
  "id1": 123,
  "id2": 456,
  "id3": 789,
...
},
...otherfields...
}

 

 

 I want to extract some key-value pairs from the "fields" object, i.e., I want to see the extracted fields in the "interesting fields" section.

For example, if I only want to extract id1 and id3, I should use 

 

 

eval new_id1 = mvindex(fields.id1, 0)
eval new_id3 = mvindex(fields.id3, 0)

 

 

 , right? Or is there another efficient way but not to use Foreach? I am new to the Splunk syntax so would appreciate any help. 

Labels (1)
Tags (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

mvindex wouldn't do anything to single valued fields.id1, fields.id3, etc.  To limit fields of interest, use fields command.

| fields fields.id1 fields.id3

If you only want to display these fields in statistics tab, use table command.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| spath fields.id1 output="new_id1"
| spath fields.id3 output="new_id3"

N.B. The spath command is built for extracting fields from JSON (and XML) structured data.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...