Splunk Search
Highlighted

Regex help

Path Finder

can somebody help on how to import the log file of the below format to splunk ?

{"Error":[{"session":abc123,"appid":12345,"errorreason":700,"appversion:"1.0"},{{"session":abc345,"appid":67890,"errorreason":123,"appversion:"1.0"},{{"session":abc678,"appid":123789,"errorreason":701,"appversion:"1.1"},"status":"success","currentpage":1,"perpage":100,"totalentries":3,"total_pages":1}

0 Karma
Highlighted

Re: Regex help

Ultra Champion

See these docs pages.

http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/Aboutgettingdatain
http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

since you don't seem to have a timestamp in your events, you'd probably need to set DATETIME_CONFIG = CURRENT in props.conf for your sourcetype.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

As for field extraction, the command spath can be used to extract fields from JSON-formatted data (which is what that looks like).

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Spath

Hope this helps,

K

0 Karma