Splunk Search

can't extract field in json

efrenette11
Path Finder

Hi,

I try to extract fields fron this json. I've tried with jsonkv and spath and it looks like that ' does generate problem during the extraction.

{'idFromSource':'344064','id':{'tmonline-us':{'id':'344064'}},'name':{'en-us':'NOVENUE'},'city':{'id':{},'name':{}},'timezone':'America/Los_Angeles','dma':[],'market':[],'image':[],'isTest':false,'source':'tmonline-us','idFromSource':'344064'}

Any suggestion ?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Is this the actual json data? I tried linting it and it failed. http://jsonlint.com/ . Also, have you tried using KV_MODE=JSON inprops.conf ?

0 Karma

somesoni2
Revered Legend

I think the single quotes are causing issues. Give this a try:- (replacing single quotes with double quotes)

host="*cops.jetdev2.syseng.tmcs" appCode="jms.send" | table payload | eval payload=replace(payload,"'","\"") | spath input=payload

somesoni2
Revered Legend

When ingested in Splunk what sourcetype definition you've used? (props.conf on Indexer/Heavy Forwarder)

0 Karma

efrenette11
Path Finder

I'm currently tryin to replace ' with " in the payload, but I always obtain UNBALACED QUOTES as error message.

0 Karma

efrenette11
Path Finder

In fact there's no specific source type defined as a log loune is not all in json format. Only the payload has json as format.

Is a result this request.
host="*cops.jetdev2.syseng.tmcs" appCode="jms.send" | table payload

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...