Splunk Search

Why am I unable to extract all fields from a JSON event?

Explorer

I am trying to extract the key/value pairs in this Json field:

[DataJson={"Code":"Error","Reason":"Failed
to locate your record. Message [No
record]"}]

I tried doing this:

spath | rename Code AS Code, Reason AS Reason | table _time, Code, Reason

I only get values for _time, but not for Code and Reason. I would appreciate your help.

Thanks in advance

Builder

Try extracting field of DataJson and then running spath on that field...

search with rex to extract DataJson | spath input=DataJson

Did not doublecheck syntax.

0 Karma

SplunkTrust
SplunkTrust

I think spath doesn't like the format of your JSON field.
Try this instead:

your search here
| rex field=_raw "(?msi)^\[[^=]+=(?<my_json>.+)\]$"
| spath input=my_json 
| rename Code AS Code, Reason AS Reason 
| table _time, Code, Reason

Explorer

Still only returned values for _time

0 Karma

Builder

Is the my_json field getting extracted correctly? Starting and ending with {}? If not you will need to tweak regex.

{"Code":"Error","Reason":"Failed to locate your record. Message [Norecord]"}

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!