Splunk Search

Parsing string with whitespaces as json object

mipa04
Engager

Hi, I am completely new to splunk and have to parse field that looks like this:
params="['field1: value1', 'field2: value2', 'field3: value3']" (note spaces after colons) - I have to extract field1, field2, field3 to be searchable - can you help with what query should I write?

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Like @ITWhisperer said, this is not JSON.  AND a strange choice of data format.  How to extract what you need depends quite on string values of "field1" "field2", "value1", "value2", etc.  If none of "fieldN", "valueN" contains hard breakers such as white space, you do something as simple as

 

| rex mode=sed field=params "s/: */=/g"
| rename _raw as temp, params AS _raw
| kv
| rename temp AS _raw

 

(I assume that you already have the field params.)

If the data is more complex than that, you will need to reconstruct data.  One way is to convert the structure into conformant JSON.  For example,

 

| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

Here is a complete emulation

 

| makeresults
| fields - _*
| eval params = "['field1: value1', 'field2: value2', 'field3: value3']"
| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

field1field2field3params
value1value2value3{"field1":"value1", "field2":"value2", "field3":"value3"}

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Like @ITWhisperer said, this is not JSON.  AND a strange choice of data format.  How to extract what you need depends quite on string values of "field1" "field2", "value1", "value2", etc.  If none of "fieldN", "valueN" contains hard breakers such as white space, you do something as simple as

 

| rex mode=sed field=params "s/: */=/g"
| rename _raw as temp, params AS _raw
| kv
| rename temp AS _raw

 

(I assume that you already have the field params.)

If the data is more complex than that, you will need to reconstruct data.  One way is to convert the structure into conformant JSON.  For example,

 

| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

Here is a complete emulation

 

| makeresults
| fields - _*
| eval params = "['field1: value1', 'field2: value2', 'field3: value3']"
| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

field1field2field3params
value1value2value3{"field1":"value1", "field2":"value2", "field3":"value3"}
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That isn't a JSON object, so you could try using rex to parse it - you could try something like this

| rex max_match=0 "'(?<field>\w+:\s[^']+)'"
| mvexpand field
| rex field=field "(?<name>\w+):\s(?<value>.*)"
| eval {name} = value
| fields - name value
| stats values(*) as * by _raw

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...