Splunk Search

How to parse JSON like-data with extracted server name as a column?

modulussplunk
Loves-to-Learn

Howdy

 

We've got this data:

 

Each log line is like:

{"serverX.somedom.com" : {"key.value.pair1": "0", "key.value.pair2": "1", "key.value.pair3": "2" }}

How can I access any of  key value pairs I want and  use the serverX.somedom.com  as well?

 

To produce something like:

 

|Server|key.value.pair1|key.value.pair2|Time|

|serverX.somedom.com|0|1|"time"

 

I've looked for lots of JSON and/or spath commands/post but I'm needing some more knowledge here..

 

Thanks!

 

 

 

Labels (2)
Tags (1)
0 Karma

modulussplunk
Loves-to-Learn

BTW, I could 'hack' this by using split and mvindex but that seems very hackish...like grep/sed/awk...I am trying to actually understand how to to this 'properly.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

Stay Connected: Your Guide to August Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Unleash the Power of Splunk MCP and AI, Meet Us at .Conf 2025, and Find Even More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...