Splunk Search

How to extract values of a particular field for a json event.

tsm0099
Explorer

I have an event which is in json and it has a repeating field say "message"

Example:

{

"Message":[

{

"message":"xyz987"

},

{

"message":"abc123"

},

{

"message":"abc456"

},

{

"message":"abc567"

},

]

}

 

I have to form a table with the values of message that only starts with abc(i.e abc123, abc456, abc567) and exclude the other values(i.e xyz987)

 

How may I achieve this?

 

Thanks in advance

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
| makeresults | eval _raw="{
\"Message\":[
{
\"message\":\"xyz987\"
},
{
\"message\":\"abc123\"
},
{
\"message\":\"abc456\"
},
{
\"message\":\"abc567\"
},
]
}" | spath | mvexpand "Message{}.message"
| where match('Message{}.message',"^abc.*")
---
If this reply helps you, Karma would be appreciated.

tsm0099
Explorer

How do i form a table with those values?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...