Splunk Search

Parse JSON string with different structures

ashodha
Engager

We have Multiple apps that generate logs and there format is little different . 

Splunk currently just shows that field as just a string ex: 

{

id:1,

log:  " {k1:v1,K2:v2}"

}

The K1 and K2 are not searchable.

log can have different format messages but we want all of them to be searchable. 

Thanks

 

Labels (2)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="{\"id\":1,\"log\":\"\\\"{k1:v1,K2:v2}\\\"\"}"
| eval data=_raw
| rename COMMENT as "this is sample"
| spath input=data
| rex field=log mode=sed "s/(?<key>\w+):\s*(?<value>\w+)/\"\1\":\"\2\"/g s/\"(.*)\"/\1/"
| spath input=log
| search k1="v1"

It might be a little annoying.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @ashodha,

I think you see the "log" field, you can use spath like below;

| spath input=log
| search k1="v1" K2="v2"

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...