Splunk Search

how to convert JSON property of event to string?

Mayukh
Engager

Hello,

I have a HEC with events like the following:

 

{
    "Log": {
        "Status": "Ordered",
        "Platform": {
            "A": {
                "Tracking": {"Field1": "Value1", "Field2": "Value2"}
            }
        }
    }
}

 

When I run the query

 

index="my_index" AND Log.Status="Ordered" 
| table Log.Status Log.Platform.A.Tracking

 

  • I get all the data for Status.
  • However my requirement is to have the JSON object Log.Platform.A.Tracking in a string format - the JSON as a String?

How can I achieve this?

Labels (2)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=Log.Status output=Status
| spath path=Log.Platform.A.Tracking output=Tracking
| table Status Tracking

View solution in original post

Mayukh
Engager

Thank you so much!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=Log.Status output=Status
| spath path=Log.Platform.A.Tracking output=Tracking
| table Status Tracking
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...