Splunk Search

Searching on a specific field in JSON

fredsnertz
Observer

This is probably an entry level question.  I have raw data that looks something like this:

{"id": 99999, "type": "HOST", "timestamp": "2024-04-29T10:41:39.820Z", "entity": {"ipAddress": "1.1.1.1"}, "dataName": "Testing"}

If I search for type="HOST" or entity.ipAddress="1.1.1.1" I get this entry in the results, but if I search for dataName="Testing" or even dataName=*, I get nothing.  What is different about this field?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @fredsnertz ,

see in the interesting fields from your searh what's the real ile name of dataName field (probably entity.dataName) and use it.

Using the json format fields are composite.

Ciao.

Giuseppe

0 Karma

bowesmana
SplunkTrust
SplunkTrust

There doesn't appear to be anything wrong with it - but it would require that field to be extracted so it could be searched.

Do you know if it's an indexed field or extracted at search time?

If you add | stats count by dataName to your search do you get any results - if not, then that field is not extracted.

If you run the search in verbose mode, does the dataName field show up in the fields in the left hand panel?

 

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...