Splunk Search

How to retrieve a field named as "source" in a search

william_choo
Explorer

Hi,

I was able to do a search using this SPL

index="myapp_index" source="d:\\splunk\\test.json" | spath input=payload | fields _id ident source | head 10

for the following data, but the problem I have is the "source" is giving me "d:\\splunk\\test.json" instead of the source with the IP address...

What do I need to do to extract the source and/or ignore the "source" for the filename?

william_choo_0-1623214234450.png

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Looking at your payload value field of the initial JSON object, it's not actually showing a complete valid JSON object, but that may just be your screen capture.

You can always rename the original source before the spath statement.

However, the source in the JSON is an array, so your field would be source{}, e.g. see this

| makeresults
| eval _raw="{\"id\":\"1\",\"payload\":\"{\\\"pod\\\":\\\"123\\\",\\\"source\\\":[\\\"192.168.24.1\\\":40962]}\"}"
| eval source="file"
| spath
| spath input=payload

  so you would just need to do

| rename source{} as source

View solution in original post

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Looking at your payload value field of the initial JSON object, it's not actually showing a complete valid JSON object, but that may just be your screen capture.

You can always rename the original source before the spath statement.

However, the source in the JSON is an array, so your field would be source{}, e.g. see this

| makeresults
| eval _raw="{\"id\":\"1\",\"payload\":\"{\\\"pod\\\":\\\"123\\\",\\\"source\\\":[\\\"192.168.24.1\\\":40962]}\"}"
| eval source="file"
| spath
| spath input=payload

  so you would just need to do

| rename source{} as source

View solution in original post

Tags (1)
0 Karma

william_choo
Explorer

Hi,

Thanks for your help with the renaming of source field ... source{} did the trick!

However, I was reading up List - Splunk Documentation
and still trying to retrieve the source IP address and source port from this field via source{}[0] and source{}[1], but I'm still struggling with trying to get this.

Can you pls share how this can be done correctly? Thank you!

"source": ["222.186.42.164", 4780],

0 Karma

bowesmana
SplunkTrust
SplunkTrust
| rename source{} as source
| eval ip=mvindex(source,0), port=mvindex(source,1)
0 Karma

william_choo
Explorer

Thank you! That did it!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!