Splunk Search

Parsing string with whitespaces as json object

mipa04
Engager

Hi, I am completely new to splunk and have to parse field that looks like this:
params="['field1: value1', 'field2: value2', 'field3: value3']" (note spaces after colons) - I have to extract field1, field2, field3 to be searchable - can you help with what query should I write?

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Like @ITWhisperer said, this is not JSON.  AND a strange choice of data format.  How to extract what you need depends quite on string values of "field1" "field2", "value1", "value2", etc.  If none of "fieldN", "valueN" contains hard breakers such as white space, you do something as simple as

 

| rex mode=sed field=params "s/: */=/g"
| rename _raw as temp, params AS _raw
| kv
| rename temp AS _raw

 

(I assume that you already have the field params.)

If the data is more complex than that, you will need to reconstruct data.  One way is to convert the structure into conformant JSON.  For example,

 

| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

Here is a complete emulation

 

| makeresults
| fields - _*
| eval params = "['field1: value1', 'field2: value2', 'field3: value3']"
| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

field1field2field3params
value1value2value3{"field1":"value1", "field2":"value2", "field3":"value3"}

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Like @ITWhisperer said, this is not JSON.  AND a strange choice of data format.  How to extract what you need depends quite on string values of "field1" "field2", "value1", "value2", etc.  If none of "fieldN", "valueN" contains hard breakers such as white space, you do something as simple as

 

| rex mode=sed field=params "s/: */=/g"
| rename _raw as temp, params AS _raw
| kv
| rename temp AS _raw

 

(I assume that you already have the field params.)

If the data is more complex than that, you will need to reconstruct data.  One way is to convert the structure into conformant JSON.  For example,

 

| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

Here is a complete emulation

 

| makeresults
| fields - _*
| eval params = "['field1: value1', 'field2: value2', 'field3: value3']"
| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

field1field2field3params
value1value2value3{"field1":"value1", "field2":"value2", "field3":"value3"}
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That isn't a JSON object, so you could try using rex to parse it - you could try something like this

| rex max_match=0 "'(?<field>\w+:\s[^']+)'"
| mvexpand field
| rex field=field "(?<name>\w+):\s(?<value>.*)"
| eval {name} = value
| fields - name value
| stats values(*) as * by _raw

 

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...