Splunk Search

How to parse a string with special format into objects or variables?

jvdev
New Member

Hi there,

I have trying to use spath to try to extract fields inside a string. Currently, the string has this format..

 

 

stringField=["fieldOne": "fieldValue", "fieldTwo": "fieldValue", "fieldThree": "fieldValue"]

 

 

So, my string inside has some kinda of array with key value pairs. I would to be able to extract those fields and values in a way that I can use their information for my queries. 

I would like to be able to get the value of fieldOne by just calling the fieldOne variable/object to get it's value to perform my desire task/stats and so on.. 

I was trying something like... but no luck!

 

 

search... | spath input=stringField 
search... | eval newVariable=spath(_raw,'stringField')
search... | spath
search... | spath path=stringField output=newField

 

 

The first option of just using input with the spath command only gave me back the first field inside my string. And it was listed as {} field.

I would really appreciate the help!

Labels (3)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval stringField="{".trim(stringField,"[]")."}"
| spath input=stringField
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...