Splunk Search

Parsing string with whitespaces as json object

mipa04
Engager

Hi, I am completely new to splunk and have to parse field that looks like this:
params="['field1: value1', 'field2: value2', 'field3: value3']" (note spaces after colons) - I have to extract field1, field2, field3 to be searchable - can you help with what query should I write?

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Like @ITWhisperer said, this is not JSON.  AND a strange choice of data format.  How to extract what you need depends quite on string values of "field1" "field2", "value1", "value2", etc.  If none of "fieldN", "valueN" contains hard breakers such as white space, you do something as simple as

 

| rex mode=sed field=params "s/: */=/g"
| rename _raw as temp, params AS _raw
| kv
| rename temp AS _raw

 

(I assume that you already have the field params.)

If the data is more complex than that, you will need to reconstruct data.  One way is to convert the structure into conformant JSON.  For example,

 

| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

Here is a complete emulation

 

| makeresults
| fields - _*
| eval params = "['field1: value1', 'field2: value2', 'field3: value3']"
| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

field1field2field3params
value1value2value3{"field1":"value1", "field2":"value2", "field3":"value3"}

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Like @ITWhisperer said, this is not JSON.  AND a strange choice of data format.  How to extract what you need depends quite on string values of "field1" "field2", "value1", "value2", etc.  If none of "fieldN", "valueN" contains hard breakers such as white space, you do something as simple as

 

| rex mode=sed field=params "s/: */=/g"
| rename _raw as temp, params AS _raw
| kv
| rename temp AS _raw

 

(I assume that you already have the field params.)

If the data is more complex than that, you will need to reconstruct data.  One way is to convert the structure into conformant JSON.  For example,

 

| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

Here is a complete emulation

 

| makeresults
| fields - _*
| eval params = "['field1: value1', 'field2: value2', 'field3: value3']"
| rex mode=sed field=params "s/'/\"/g s/ *: */\":\"/g s/\[/{/ s/]/}/"
| spath input=params

 

field1field2field3params
value1value2value3{"field1":"value1", "field2":"value2", "field3":"value3"}
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That isn't a JSON object, so you could try using rex to parse it - you could try something like this

| rex max_match=0 "'(?<field>\w+:\s[^']+)'"
| mvexpand field
| rex field=field "(?<name>\w+):\s(?<value>.*)"
| eval {name} = value
| fields - name value
| stats values(*) as * by _raw

 

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...