Splunk Search

Programmatically parse random key name in json for subfield

mmccul_fe
Explorer

Data resembles this pattern.

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}"

I am trying to extract the two FQDNs when the containing field name foo{}.* is a random string. Any hints on how to get this data?

I've tried a few different options with spath and can't seem to get it to work. I could try a rex, but I was really hoping to avoid that.

Basically, what I want at the end is a field (multivalue in this case) that has as value ibar.example.com and jbar.example.com.

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}"
| kv
| foreach *fqdn [ eval mvfield=mvappend(mvfield, '<<FIELD>>') ]

This way, as long as the fields end in fqdn, you get them merged into a field called mvfield.

0 Karma

to4kawa
Ultra Champion
....
|rex max_match=0 "\"fqdn\" : \"(?<fqdn>.*?)\""
0 Karma

anmolpatel
Builder

such a neat solution 🙂

0 Karma

anmolpatel
Builder

@mmccul_fe like this?

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}" 
| spath 
| rename foo{}.* as * randstring*.fqdn as randstring*
| eval fqdn = ""
| foreach randstring* [eval fqdn = fqdn + " " + '<<FIELD>>']

Note: the screenshot is an older image, i've renamed column3 "randstring" to fqdn in my answer

Results:
alt text

0 Karma

mmccul_fe
Explorer

Why I don't want to use rex...

I have some events that have more than one foo above and I need to basically grab foo..fqdn sometimes, and later grab otherfoo..fqdn, knowing which one I am grabbing.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...