Splunk Search

Spath only extracts the first sublevel in Json, how to extract additional sublevels

jorjiana88
Path Finder

Hi,

How can I extract the fields from Properties.Response ? With spath I only get the whole value of Properties.Response but I found no way to extract Id, Reference, Isfallback, Registrationdare, etc.

{
"Timestamp": "2019-01-15T16:35:31.5431887+00:00",
"Level": "Information",
"Properties": {
"correlationId": "49892ff0-5c61",
"Response": "{\"Id\":\"164455245211\",\"Reference\":\"45554522-37\",\"IsFallback\":false,\"RegistrationDate\":\"2019-01-15T16:35:31.251+00:00\",\"ErrorResult\":null}",
"status": 200,
"SourceContext": "application"
}
}

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ jorjiana88

Can you please try this?

YOUR SEARCH
| kv | table Level "Properties.SourceContext" "Properties.correlationId" "Properties.status" "Properties.Response" | eval _raw='Properties.Response' | kv

I have use kv for field extraction from JSON.

My Sample Search:

| makeresults | eval _raw="{
\"Timestamp\": \"2019-01-15T16:35:31.5431887+00:00\",
\"Level\": \"Information\",
\"Properties\": {
\"correlationId\": \"49892ff0-5c61\",
\"Response\": \"{\\\"Id\\\":\\\"164455245211\\\",\\\"Reference\\\":\\\"45554522-37\\\",\\\"IsFallback\\\":false,\\\"RegistrationDate\\\":\\\"2019-01-15T16:35:31.251+00:00\\\",\\\"ErrorResult\\\":null}\",
\"status\": 200,
\"SourceContext\": \"application\"
}
}" | kv | table Level "Properties.SourceContext" "Properties.correlationId" "Properties.status" "Properties.Response" | eval _raw='Properties.Response' | kv

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ jorjiana88

Can you please try this?

YOUR SEARCH
| kv | table Level "Properties.SourceContext" "Properties.correlationId" "Properties.status" "Properties.Response" | eval _raw='Properties.Response' | kv

I have use kv for field extraction from JSON.

My Sample Search:

| makeresults | eval _raw="{
\"Timestamp\": \"2019-01-15T16:35:31.5431887+00:00\",
\"Level\": \"Information\",
\"Properties\": {
\"correlationId\": \"49892ff0-5c61\",
\"Response\": \"{\\\"Id\\\":\\\"164455245211\\\",\\\"Reference\\\":\\\"45554522-37\\\",\\\"IsFallback\\\":false,\\\"RegistrationDate\\\":\\\"2019-01-15T16:35:31.251+00:00\\\",\\\"ErrorResult\\\":null}\",
\"status\": 200,
\"SourceContext\": \"application\"
}
}" | kv | table Level "Properties.SourceContext" "Properties.correlationId" "Properties.status" "Properties.Response" | eval _raw='Properties.Response' | kv

Thanks

0 Karma

jorjiana88
Path Finder

works great, and no need for regex.. thanks!

0 Karma

saurabhkharkar
Path Finder
Try adding this regex to your search 

| rex field=Properties.Response "\{\"Id\":\"(?<Id>\d+)\",\"Reference\":\"(?<Reference>[^\"]+)\",\"IsFallback\":(?<IsFallback>[^\,]+)\,\"RegistrationDate\":\"(?<RegistrationDate>[^\"]+)\",\"ErrorResult\":(?<ErrorResult>[^\}]+)"
| table Properties.Response Id Reference IsFallback RegistrationDate ErrorResult
0 Karma

jorjiana88
Path Finder

Thanks a lot, it works, but is there any solution without regex ? Since we have a lot to work with json logs, it would be nice to have a more user friendly solution that I can show to my colleagues also.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...