Parse nested json array without direct key-value mapping

[rashmeet]

Hi, 

I have a json that looks like the following - 

{
"id": "123",
"uri": "http://xyz.com/api",
"method": "POST",
"headers": [
"Accept: application/json",
"SERVICE.ENV: qa",
"SERVICE.NAME: someservice",
"CLIENT.ID: s0m3id",
"CLIENT_TYPE: typeA",
"CLIENT_IP:123.456.7.8"
],
"cookies": [],
"message": "Request Finished",
"status": 200
}

Within the headers section, I want to capture what all CLIENT_IPs are passing other header info such as SERVICE.ENV and SERVICE.NAME. The catch being, CLIENT_IP:123.456.7.8 is all in a single pair of quotes, so it isn't being parsed as a key value pair (as per my understanding). Please help. 

[_gkollias]

Hello - 

This looks like valid JSON. Have you tried setting KV_MODE=json in props.conf?

https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Automatickey-valuefieldextractionsatsea... 

Thanks!

[rashmeet]

@_gkollias  - Thank you for the response. 
And sorry I’m absolutely new to splunk which is why I was unaware for the KV_MODE. So once it’s specified, will I be able to query with the key such as CLIENT_ID? 

I've been trying queries like - 

index=my_service
| rename @fields.headers{}.* as *
| eval a = mvzip(CLIENT_IP,CLIENT.ID,"|")
| mvexpand a
| table CLIENT_IP,CLIENT.ID

And it is giving me empty table.

[to4kawa · Accepted solution]

index=_internal |head 1 | fields _time _raw |eval _raw="{\"id\":\"123\",\"uri\":\"http://xyz.com/api\",\"method\":\"POST\",\"headers\":[\"Accept: application/json\",\"SERVICE.ENV: qa\",\"SERVICE.NAME: someservice\",\"CLIENT.ID: s0m3id\",\"CLIENT_TYPE: typeA\",\"CLIENT_IP:123.456.7.8\"],\"cookies\":[],\"message\":\"Request Finished\",\"status\":200}"
| spath headers{} output=headers
| rex field=headers max_match=0 "(?<key>\w+):\s*(?<value>\S+)"
| eval _raw=mvzip(key,value,"=")
| kv

This query extracts header array.

[rashmeet]

@to4kawa  - Thank you, that does help, much appreciated. 🙂