Splunk Search

How to use JSON extracted fields with eval function typeof?

nfieglein
Path Finder

When I try to do anything with the JSON fields extracted during data input, I get things like Invalid when I do typeof in an eval. I can see the extracted fields in the UI and the Timestamp is correctly used. I have tried the following:
sourcetype=json | eval myField=typeof(LogEntry.Content.Amdps1204ipmCpy.Dps1204Ipm.HeaderSegmentGrp.CreationDate)
which is clearly a string, but returns Invalid. I cannot execute a strptime on it either.

I have the following as an example of JSON log data. According to the JSONLint validator, it is a valid JSON message.
{
"Timestamp":"2014-11-03 14:34:55",
"Type":"INFO ",
"Class":"TopicListenner:?",
"LogEntry":
{
"source":"AMDPS",
"Content": {
"Amdps1204ipmCpy":{
"Dps1204Ipm":{
"CustomerSegmentGrp":{
"CustomerNumBuid":"000000707","CustomerNum":"7777777","DpsType":"EXG","CompanyNum":"02","RequestingService":"Safder Memon"}
,"OrderSegmentGrp":{
"ExgOrderNum":"000000000490644069","DomsStatusDate":20141103,"DspStatusCode":"0000","DomsStatusCode":"SC","PoNum":38045618}
,"PartsSegmentGrp":{
"PartsSegment":[{
"SkuMfgNbr":"89HT1","QuantityAtFsb":"0000000000","PartDescription":"KIT,MEDIA,DVD,RDVD,7737","Quantity":"000000001"}
,{
"SkuMfgNbr":"CY2KJ","QuantityAtFsb":"0000000000","PartDescription":"KIT,SW,W8H/P64,MUL24","Quantity":"000000001"}
]}
,"FsbLocationGrp":{
"FsbLocationSegment":[{
"VendorId":"0016","VendorInfo":[{
"MilesToFsb":"0007","FsbLocation":"WYOW1"}
,{
"MilesToFsb":"0092","FsbLocation":"WYUL1"}
,{
"MilesToFsb":"0092","FsbLocation":"WYGK1"}
]}
,"","",""]}
,"JobSegmentGrp":{
"JobIndx":0}
,"ContactSegmentGrp":{
"TelephoneNbr":5555555555,"ContactName":"NOONE SPECIAL","PhoneExtension":"00000"}
,"HeaderSegmentGrp":{
"CreationDate":"Mon Nov 03 14:34:54 CST 2014","OperationType":"TRN"}
,"CommentSegmentGrp":{
"CommentSegment":[{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"P:Media Request","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"D:Media Request","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"cx called in bec he would like to reinstall the","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"OS however he don't have the Media Recovery disc,","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"cx requesting for it, he would like to reinstall","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"the OS bec there's a lot of stuff or apps on","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"system and cx would like to refresh or to clean","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"it up, he wants to remove all the files and data.","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"inform cx the this request is a one time deal","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"only, cx understand, inform also cx the warranty","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"details. done CDO - set to prio 4","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"SYSTEM: Inspiron 17","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"BTTR: Cx declined follow-up","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Consulted: CM POC Ice Bordeos","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Heat Check: SAT","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Captured, verified and updated Customer Name and","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Contact info in SR header.","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Captured, keyspelled and updated email address","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"in SR header.","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"VA TOADE","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Cx agreed to 'One-Strike policy'","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Provided Ownership Spiel/s","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"FTF USED. ARTICLE NUMBER: non compliance","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Audibly obtained PN","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"No APN","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"VDI Told cust about Refurb replacement parts","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"VPKRS: No need for plastic replacement","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Media Check. Customer has: None","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Provided TAT: 1-2 BD","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"CRU/FRU part/s verified thru DTT/EducateDell","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Provided Moxie as a lifeline","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Sent summary email during call. Customer","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"confirmed e-mail is received.","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Gave service request number to customer.","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"THIS IS AN ALABANG DISPATCH","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"S:dps media","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Created from DellServ Case #999999999","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"ETSB SOME OTHERTECH","DetailProblemDesc":"PART OK","CommentDate":20141101}
,{
"CommentType":"EXG","TechName":"ETSB SOME OTHERTECH","DetailProblemDesc":"RS APPROVED DPS","CommentDate":20141101}
]}
,"RaSegmentGrp":{
"RaFlag":"N"}
,"AddressSegmentGrp":{
"TimeZone":"EST","EdiRegionCode":"CA","StreetTwo":"Suite 3333","State":"ON","ZipCode":"999 999","City":"Gloucester","CountryCode":"CA","StreetOne":"9999 Duck St"}
,"StatusSegmentGrp":{
"StatusDate":"20141103:14:34:54.495440","RecordType":"C","StatusCode":"TTC"}
,"TranhistSegmentGrp":{
"EventDate":"20141103:14:34:54.448741","VendorNum":"0016","VendorDate":"20141104:16:00","EventCode":"VX","EventComments":"RTN WAYBILL#: KAM001231827"}
,"SvctagSegmentGrp":{
"ModelNumber":"DZ","ServiceLevel":"CP","TechNameIssuedCall":"STC:
SOME TECH","DspReplyCode":"0000","TechBadgeNumIssuedCall":659662,"ReasonCode":"SW3F","TechIdIssuedCall":"000251779","Buid":"000000707","ItemSubClass":"002","Svctag":"B375ST1","DpsNum":"000175479487","ProductDesc":"7737,NOTEBOOK,HADLEY 17FBTX","LineOfBusiness":55}
}
}
}
}
}

0 Karma
1 Solution

nfieglein
Path Finder

OK. In order to use the JSON field, it has to be in single quotes. The following work:
sourcetype=json | eval myField=typeof('LogEntry.Content.Amdps1204ipmCpy.Dps1204Ipm.HeaderSegmentGrp.CreationDate')
sourcetype=json | eval myField=strptime('LogEntry.Content.Amdps1204ipmCpy.Dps1204Ipm.HeaderSegmentGrp.CreationDate', "%a %b %d %H:%M:%S %Z %Y")

View solution in original post

nfieglein
Path Finder

OK. In order to use the JSON field, it has to be in single quotes. The following work:
sourcetype=json | eval myField=typeof('LogEntry.Content.Amdps1204ipmCpy.Dps1204Ipm.HeaderSegmentGrp.CreationDate')
sourcetype=json | eval myField=strptime('LogEntry.Content.Amdps1204ipmCpy.Dps1204Ipm.HeaderSegmentGrp.CreationDate', "%a %b %d %H:%M:%S %Z %Y")

rmruiz
New Member

awesome!... but why??

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...