Splunk Search

Programmatically parse random key name in json for subfield

mmccul_fe
Explorer

Data resembles this pattern.

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}"

I am trying to extract the two FQDNs when the containing field name foo{}.* is a random string. Any hints on how to get this data?

I've tried a few different options with spath and can't seem to get it to work. I could try a rex, but I was really hoping to avoid that.

Basically, what I want at the end is a field (multivalue in this case) that has as value ibar.example.com and jbar.example.com.

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}"
| kv
| foreach *fqdn [ eval mvfield=mvappend(mvfield, '<<FIELD>>') ]

This way, as long as the fields end in fqdn, you get them merged into a field called mvfield.

0 Karma

to4kawa
Ultra Champion
....
|rex max_match=0 "\"fqdn\" : \"(?<fqdn>.*?)\""
0 Karma

anmolpatel
Builder

such a neat solution 🙂

0 Karma

anmolpatel
Builder

@mmccul_fe like this?

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}" 
| spath 
| rename foo{}.* as * randstring*.fqdn as randstring*
| eval fqdn = ""
| foreach randstring* [eval fqdn = fqdn + " " + '<<FIELD>>']

Note: the screenshot is an older image, i've renamed column3 "randstring" to fqdn in my answer

Results:
alt text

0 Karma

mmccul_fe
Explorer

Why I don't want to use rex...

I have some events that have more than one foo above and I need to basically grab foo..fqdn sometimes, and later grab otherfoo..fqdn, knowing which one I am grabbing.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...