Splunk Search

Index JSON data

Motivator

Hi all,

I would like to index JSON data like this, My ultimate aim is to move the fields(college, university, examdate) to the individual array element and index.

 college=college1    studentname=name1    mark=98    subject=science    university=university1    examdate=10-12-14
 college=college1    studentname=name2    mark=99    subject=science    university=university1    examdate=10-12-14
 college=college2    studentname=name21    mark=80    subject=science    university=university1    examdate=10-12-14
 college=college2    studentname=name22    mark=100    subject=science    university=university1   examdate=10-12-14

Sample JSON,

{
   "studentsmarks": {
     "subject": "science",
     "university": "university1",
     "examdate": "10-12-14"
   },
   "students": [
     {
       "college": "college1",
       "studentname": "name1",
       "mark": "98"
     },
     {
       "college": "college1",
       "studentname": "name2",
       "mark": "99"
     },
     {
       "college": "college2",
       "studentname": "name21",
       "mark": "80"
     },
     {
       "college": "college2",
       "studentname": "name22",
       "mark": "100"
     }
   ]
 }

Cheeerrss!

Motivator

run this search :
| gentimes start=-1 | eval temp="{\"studentsmarks\":{\"subject\":\"science\",\"university\":\"university1\",\"examdate\":\"10-12-14\"},\"students\":[{\"college\":\"college1\",\"studentname\":\"name1\",\"mark\":\"98\"},{\"college\":\"college1\",\"studentname\":\"name2\",\"mark\":\"99\"},{\"college\":\"college2\",\"studentname\":\"name21\",\"mark\":\"80\"},{\"college\":\"college2\",\"studentname\":\"name22\",\"mark\":\"100\"}]}" | table temp | rename temp as _raw | spath | rename students{}.* as * |rename studentsmarks.* as * | eval temp=mvzip(college,mvzip(mark,studentname,"#"),"#") | mvexpand temp | rex field=temp "(?.*)#(?.*)#(?.*)" |table college university examdate | outputcsv your_csv_name

after go to /splunk_home/var/run/splunk/ directry and you shall see your_csv_name.csv ;
Then you Recuper in the directory your csv file and you can index your_csv_name.csv file

0 Karma

Motivator

Hey,

How this will help me? are you ask me to index twice? then what happen to the license?

I would like to handle it in index time.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!