Splunk Search

help with backslash

curiousvivek
Engager

 

 

 

 

 

{
  \\\"person\\\":{\\\"name\\\":{\\\"firstName\\\":\\\"John\\\",\\\"lastName\\\":\\\"Doe\\\"},\\\"address\\\":{\\\"street\\\":\\\"100 Main Ave\\\",\\\"city\\\":\\\"Redwood City\\\",\\\"usState\\\":\\\"CA\\\",\\\"zipCode\\\":\\\"94061\\\",\\\"country\\\":\\\"United States\\\",\\\"phones\\\":[],\\\"emails\\\":[],\\\"addressLines\\\":[]},\\\"addresses\\\":[],\\\"phones\\\":[{\\\"phoneType\\\":\\\"Home\\\",\\\"phoneNumber\\\":\\\"6500000000\\\"}],\\\"email\\\":\\\"johndoe@gmail.com\\\",\\\"dateOfBirth\\\":\\\"1900/01/01\\\",\\\"nationalId\\\":\\\"100\\\",\\\"gender\\\":\\\"Male\\\"},\\\"credential\\\":{\\\"userName\\\":\\\"johndoe@gmail.com\\\",\\\"password\\\":\\\"Password\\\",\\\"securityQuestion\\\":\\\"Name of First Car?\\\",\\\"securityAnswer\\\":\\\"Volvo\\\"}\""
}

 

 

 

 

I need help in getting email in splunk search query for above json which has blackslash in logs.  I have grabbed the nametag from very big log json using spath and i am calling that tag as "nametagforthisjson"  to simplify.


I tried this : 

 

| rex field=nametagforthisjson max_match=0 "\"email:\\\\\\\":\\\\\\\"(?<email>.*)\"(?=,)"
| table email

 



I see email label printed but not value . So my regex is wrong. the email value johndoe@gmail.com is for email name tag . So the value is until semicolon (,) . I am putting 7 blackslash.(2 backslash for 1 \  and 1 for ")
regex  query version https://regex101.com/r/8BevNW/1

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval formattedjson = trim(replace(nametagforthisjson,"\\\\", ""),"\"")
| spath field=formattedjson path=person.email output=email
| table formattedjson, email

View solution in original post

curiousvivek
Engager

Thanks,I did this :

 

| eval formattedjson = replace(nametagforthisjson,"\\\\", "")| table formattedjson

 



that but now i have json enclosed in double quotes

[see below]

 

"{
  "person": {
    "name": {
      "firstName": "John",
      "lastName": "Doe"
    },
    "address": {
      "street": "100 Main st",
      ...
      "phones": [
        
      ],
      "emails": [
        
      ],
      "addressLines": [
        
      ]
    },
    "addresses": [
      
    ],
    "phones": [
      {
        "phoneType": "Mobile",
        "phoneNumber": "65000000"
      }
    ],
    "email": "johdoe@gmail.com",
   ....
      
  }
  
}"

 

What should I do to remove this enclosing double quotes?
Once this is success, I want to do
eval email = json_extract('formattedjson',"person.email") 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval formattedjson = trim(replace(nametagforthisjson,"\\\\", ""),"\"")
| spath field=formattedjson path=person.email output=email
| table formattedjson, email

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried replacing \\ with nothing and \" with ", then use spath to extract the field you want?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...