Splunk Search
Highlighted

Why am I unable to extract all fields from a JSON event?

Explorer

I am trying to extract the key/value pairs in this Json field:

[DataJson={"Code":"Error","Reason":"Failed
to locate your record. Message [No
record]"}]

I tried doing this:

spath | rename Code AS Code, Reason AS Reason | table _time, Code, Reason

I only get values for _time, but not for Code and Reason. I would appreciate your help.

Thanks in advance

Highlighted

Re: Why am I unable to extract all fields from a JSON event?

SplunkTrust
SplunkTrust

I think spath doesn't like the format of your JSON field.
Try this instead:

your search here
| rex field=_raw "(?msi)^\[[^=]+=(?<my_json>.+)\]$"
| spath input=my_json 
| rename Code AS Code, Reason AS Reason 
| table _time, Code, Reason
Highlighted

Re: Why am I unable to extract all fields from a JSON event?

Explorer

Still only returned values for _time

0 Karma
Highlighted

Re: Why am I unable to extract all fields from a JSON event?

Builder

Is the my_json field getting extracted correctly? Starting and ending with {}? If not you will need to tweak regex.

{"Code":"Error","Reason":"Failed to locate your record. Message [Norecord]"}

0 Karma
Highlighted

Re: Why am I unable to extract all fields from a JSON event?

Builder

Try extracting field of DataJson and then running spath on that field...

search with rex to extract DataJson | spath input=DataJson

Did not doublecheck syntax.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.