Splunk Search

Searching on a specific field in JSON

fredsnertz
Observer

This is probably an entry level question.  I have raw data that looks something like this:

{"id": 99999, "type": "HOST", "timestamp": "2024-04-29T10:41:39.820Z", "entity": {"ipAddress": "1.1.1.1"}, "dataName": "Testing"}

If I search for type="HOST" or entity.ipAddress="1.1.1.1" I get this entry in the results, but if I search for dataName="Testing" or even dataName=*, I get nothing.  What is different about this field?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @fredsnertz ,

see in the interesting fields from your searh what's the real ile name of dataName field (probably entity.dataName) and use it.

Using the json format fields are composite.

Ciao.

Giuseppe

0 Karma

bowesmana
SplunkTrust
SplunkTrust

There doesn't appear to be anything wrong with it - but it would require that field to be extracted so it could be searched.

Do you know if it's an indexed field or extracted at search time?

If you add | stats count by dataName to your search do you get any results - if not, then that field is not extracted.

If you run the search in verbose mode, does the dataName field show up in the fields in the left hand panel?

 

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...