Splunk Search

Not able to use JSON fields in search

sabari80
Explorer

This is my sample event

onlinequoteinguser 2023-01-11T10:27:13,843 INFO DigitalPortal.xxxeSubmissionUtil
{"hostName": "xxx80hlxxda044",
"SourceSystem": "null",
"level": "INFO",
"message": "Start | newSubmission",
"serverId": "prod-xxx_xx78",
"userId": "onlinequoteinguser",
"contextMap": [
{"JsonRpcId":"b55296cf-81e1-4xxx-8064-052dxx416725_5"},
{"methodName":"createOrUpdateDraftSubmission"},
{"traceabilityID":"7cxxx367-09aa-4367-87d4-b120526xxxcb"},
{"requestPath":"\/edge\/xxxquoteflow\/letsgetstarted"}],
"applicationName": "xx",
"timestamp": "20230111T102713.841-0500"}

here is my query to retrieve specific event based my my JSON field 

index=app_xx Appid="APP-xxxx" Environment=PROD "contextMap{}.methodName"="createOrUpdateDraftSubmission" 

 

How to make appropriate search?

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

A job for spath.  But first, you need to separate the JSON object.

 

| eval eSubmission = replace(_raw, "onlinequoteinguser .*eSubmissionUtil", "")
| spath input=eSubmission
| fields - data eSubmission

 

Your sample data gives

sourceSystemapplicationNamecontextMap{}.JsonRpcIdcontextMap{}.methodNamecontextMap{}.requestPathcontextMap{}.traceabilityIDhostNamelevelmessageserverIdtimestampuserId
nullxxb55296cf-81e1-4xxx-8064-052dxx416725_5createOrUpdateDraftSubmission/edge/xxxquoteflow/letsgetstarted7cxxx367-09aa-4367-87d4-b120526xxxcbxxx80hlxxda044INFOStart | newSubmissionprod-xxx_xx7820230111T102713.841-0500onlinequoteinguser

Here is the emulation I used.  You can play with it and compare to real data.

 

| makeresults
| fields - _time
| eval data = "onlinequoteinguser 2023-01-11T10:27:13,843 INFO DigitalPortal.xxxeSubmissionUtil
{\"hostName\": \"xxx80hlxxda044\",
\"SourceSystem\": \"null\",
\"level\": \"INFO\",
\"message\": \"Start | newSubmission\",
\"serverId\": \"prod-xxx_xx78\",
\"userId\": \"onlinequoteinguser\",
\"contextMap\": [
{\"JsonRpcId\":\"b55296cf-81e1-4xxx-8064-052dxx416725_5\"},
{\"methodName\":\"createOrUpdateDraftSubmission\"},
{\"traceabilityID\":\"7cxxx367-09aa-4367-87d4-b120526xxxcb\"},
{\"requestPath\":\"\/edge\/xxxquoteflow\/letsgetstarted\"}],
\"applicationName\": \"xx\",
\"timestamp\": \"20230111T102713.841-0500\"}"
``` data emulation above ```

 

 

View solution in original post

Tags (2)

yuanliu
SplunkTrust
SplunkTrust

A job for spath.  But first, you need to separate the JSON object.

 

| eval eSubmission = replace(_raw, "onlinequoteinguser .*eSubmissionUtil", "")
| spath input=eSubmission
| fields - data eSubmission

 

Your sample data gives

sourceSystemapplicationNamecontextMap{}.JsonRpcIdcontextMap{}.methodNamecontextMap{}.requestPathcontextMap{}.traceabilityIDhostNamelevelmessageserverIdtimestampuserId
nullxxb55296cf-81e1-4xxx-8064-052dxx416725_5createOrUpdateDraftSubmission/edge/xxxquoteflow/letsgetstarted7cxxx367-09aa-4367-87d4-b120526xxxcbxxx80hlxxda044INFOStart | newSubmissionprod-xxx_xx7820230111T102713.841-0500onlinequoteinguser

Here is the emulation I used.  You can play with it and compare to real data.

 

| makeresults
| fields - _time
| eval data = "onlinequoteinguser 2023-01-11T10:27:13,843 INFO DigitalPortal.xxxeSubmissionUtil
{\"hostName\": \"xxx80hlxxda044\",
\"SourceSystem\": \"null\",
\"level\": \"INFO\",
\"message\": \"Start | newSubmission\",
\"serverId\": \"prod-xxx_xx78\",
\"userId\": \"onlinequoteinguser\",
\"contextMap\": [
{\"JsonRpcId\":\"b55296cf-81e1-4xxx-8064-052dxx416725_5\"},
{\"methodName\":\"createOrUpdateDraftSubmission\"},
{\"traceabilityID\":\"7cxxx367-09aa-4367-87d4-b120526xxxcb\"},
{\"requestPath\":\"\/edge\/xxxquoteflow\/letsgetstarted\"}],
\"applicationName\": \"xx\",
\"timestamp\": \"20230111T102713.841-0500\"}"
``` data emulation above ```

 

 

Tags (2)

richgalloway
SplunkTrust
SplunkTrust

Please share the props.conf settings for that sourcetype.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...