Splunk Search

How to join a json log source with Json format with a log source with key = value pairs log format....

lpolo
Motivator

I have a query that is able to join two or more source types with the same log format in each source log (all log with key=value pair format). However, I am having difficulties to join two or more source types if the source logs are not in the same format (e.g., one source log is in json format and the other is in key=value pair format).
All logs are joined by the id key name found in each source log.

This is main construct to join two source types with the same key=value pair format:

(sourcetype="request" AND application=vsp NOT (Agent.007) )  OR
(sourcetype="response")
stats
 first(key_name1) as key1
 list(key_name2) as key2 
 dc(sourcetype) as dc by id|
 search dc=2 

Can anyone share any example to join one source log with json format and another source log with key=value pair format a common key name?

any idea?

Thanks,
Lp

Tags (2)
0 Karma

lpolo
Motivator

The following query construct should works:

(sourcetype="request" AND application=vsp NOT (Agent.007) key_name1 )
 OR
(sourcetype="response" key_name2)
| spath
| spath path=your_json_path output=your_output_key_name1
| spath path=your_json_path output=your_output_key_name2
| spath path=your_json_path output=your_output_key_name3
...
| spath path=your_json_path output=your_output_key_name4
stats
 first(your_output_key_name1) as your_output_key_name1
 first(your_output_key_name2) as your_output_key_name2
 first(your_output_key_name3) as your_output_key_name3
 first(your_output_key_name4) as your_output_key_name4
 first(key_name1) as key1
 list(key_name2) as key2 
 dc(sourcetype) as dc by id

Note: if the output spath variables are multivalue use the following stats functions: list() or values(). For more information about this functions go to:

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions

0 Karma
Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...