Splunk Search

Programmatically parse random key name in json for subfield

mmccul_fe
Explorer

Data resembles this pattern.

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}"

I am trying to extract the two FQDNs when the containing field name foo{}.* is a random string. Any hints on how to get this data?

I've tried a few different options with spath and can't seem to get it to work. I could try a rex, but I was really hoping to avoid that.

Basically, what I want at the end is a field (multivalue in this case) that has as value ibar.example.com and jbar.example.com.

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}"
| kv
| foreach *fqdn [ eval mvfield=mvappend(mvfield, '<<FIELD>>') ]

This way, as long as the fields end in fqdn, you get them merged into a field called mvfield.

0 Karma

to4kawa
Ultra Champion
....
|rex max_match=0 "\"fqdn\" : \"(?<fqdn>.*?)\""
0 Karma

anmolpatel
Builder

such a neat solution 🙂

0 Karma

anmolpatel
Builder

@mmccul_fe like this?

| makeresults 
| eval _raw="{\"foo\": [{\"randstring1\": {\"fqdn\" : \"ibar.example.com\"}}, {\"randstring2\": {\"fqdn\" : \"jbar.example.com\"} }]}" 
| spath 
| rename foo{}.* as * randstring*.fqdn as randstring*
| eval fqdn = ""
| foreach randstring* [eval fqdn = fqdn + " " + '<<FIELD>>']

Note: the screenshot is an older image, i've renamed column3 "randstring" to fqdn in my answer

Results:
alt text

0 Karma

mmccul_fe
Explorer

Why I don't want to use rex...

I have some events that have more than one foo above and I need to basically grab foo..fqdn sometimes, and later grab otherfoo..fqdn, knowing which one I am grabbing.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...