Splunk Search

How to extract, kv pair from jvm_cmd value & print those in Splunk search?

pmittal
Engager

raw event

{... "jvm_cmd":"bin/java -Dp -Dp1=v1-Dp2=v2 -Dq -Dp3=v3 ..."}

How to extract, kv pair from jvm_cmd value & print those in Splunk search?

I am not admin. So, I can't change props.conf or transform.conf. I tried https://community.splunk.com/t5/Splunk-Search/Using-KV-MODE-auto-in-props-conf-how-do-I-get-a-search... and rex without any success. Any help will be much appreciated

 

 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

@pmittal Are you thinking of kv aka extract?

| rename _raw as tmp, jvm_cmd as _raw
| kv pairdelim="-"
| rename D* as *

 

0 Karma

pmittal
Engager

Apologies for the delayed response. I used REX meanwhile to extract required fields but it was not a full proof solution because I should know fields to be extracted in advance which is not possible. This is where @yuanliu solution worked as expected.

One final clarification - This solution worked only if jvm_cmd is renamed as _raw. Is it possible to avoid renaming and worked directly on jvm_cmd?

0 Karma

yuanliu
SplunkTrust
SplunkTrust

One final clarification - This solution worked only if jvm_cmd is renamed as _raw. Is it possible to avoid renaming and worked directly on jvm_cmd?


To be honest, there were multiple times I wished that was possible but no. However, in your case, the JSON object is already in _raw. You can try your luck by simply apply | kv without any predisposition. The worst that can happen is that, in addition to possibly extracting additional fields from other JSON nodes that may contain equal-sign-separated kv pairs, some of these interfere with those pairs in jvm_cmd. So, manually test with a meaningful amount of sample. (Or ask your developer if any other fields can potentially contain equal-sign-separated pair and can potentially have overlapping keys.)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pmittal,

it seems to be a json format, did you tried with spath command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath)? 

Ciao.

Giuseppe

0 Karma

pmittal
Engager

I am not sure how that's gonna solve the problem. I am trying to parse jvm_cmd value and it's not a JSON. Can you share some sample spath if I misunderstood you?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pmittal,

you can find all the information and samples in the above link.

Ciao.

Giuseppe

0 Karma

pmittal
Engager

I tried it before posting without any success. All the example in that link has value itself as either JSON or XML whereas in this case no fixed pattern in value

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pmittal,

if possible, please share a sample of your data that's also useful to create a regex.

Ciao.

Giuseppe

0 Karma

pmittal
Engager

it's there in initial post. I need that P1=v1, p2=v2 ... key pairs extracted

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pmittal,

{... "jvm_cmd":"bin/java -Dp -Dp1=v1-Dp2=v2 -Dq -Dp3=v3 ..."} isn't a full log, if possible, share a full log to understand if it's a json.

Ciao.

Giuseppe

0 Karma

pmittal
Engager

log entry is a json. i can fetch jvm_cmd parmeter as it is a JSON key. that's not the issue. I need to parse value of jvm_cmd. can't share full log due to sensitive information. I tried following Splunk query (few other variations too). It just print log/raw json fields but it won't extract fields out of jvm_cmd value

index=abc jvm_cmd=*xyz* | spath | table *

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pmittal,

if you're sure that you have a json format the spath command should extract all the fields, also the one you need.

If you want to extract only one field, you could follow the 5th example of the link https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

Could you mask a sample of your data to share?

Ciao.

Giuseppe

0 Karma

pmittal
Engager

I don't have to retrieve field value. I have to retrieve key value pair located inside field value. Either you are not getting my point or I am not getting yours at all. Please see java_cmd param value. need to get K,V pair out of it 

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...