Splunk Search

how to convert JSON property of event to string?

Mayukh
Engager

Hello,

I have a HEC with events like the following:

 

{
    "Log": {
        "Status": "Ordered",
        "Platform": {
            "A": {
                "Tracking": {"Field1": "Value1", "Field2": "Value2"}
            }
        }
    }
}

 

When I run the query

 

index="my_index" AND Log.Status="Ordered" 
| table Log.Status Log.Platform.A.Tracking

 

  • I get all the data for Status.
  • However my requirement is to have the JSON object Log.Platform.A.Tracking in a string format - the JSON as a String?

How can I achieve this?

Labels (2)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=Log.Status output=Status
| spath path=Log.Platform.A.Tracking output=Tracking
| table Status Tracking

View solution in original post

Mayukh
Engager

Thank you so much!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=Log.Status output=Status
| spath path=Log.Platform.A.Tracking output=Tracking
| table Status Tracking
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...