Splunk Search

how to extract nested fields using search command

disha
Contributor

Hi,
I have a data like this. I need to extract HDID and VNM fields. Any help.

{[-]
BVER : "10.47b",
CHIP : "Bcm7425B1",
EID : 1,
FID : "45",
FVER : "STABLE-KA12.13.05.86-25350.271980",
HCNT : 1,
HDD : [
{[-]
HDID : "W1G016R6",
HID : "W1G016R6",
HMN : "ST1000VM002-9ZL162",
HSZ : "1000.2",
HTYP : 0,
HVC : 2,
VOL : [
{[-]
VNM : "gpfs",
VSZ : 3288
},
{[-]
VNM : "storage",
VSZ : 996916
}
]
}
],
IBTCNT : 6,
MID : "36866",
MT : 1477404,
PID : "832",
SID : "000-00426-37896-246",
TS : "Wed Dec 31 18:00:00 1969"
}

Right now I am able to extract first level of nesting like BVER,CHIP etc. For that My search command is:(just the simple syntax)
sourcetype="agent" | spath path="BVER" output=Bversion |fields Bversion

for spath path="HDD" it is giving the value [{"HDID":"W1G016R6","HID":"W1G016R6","HSZ":1000.2,"HMN":"ST1000VM002-9ZL162","HTYP":0,"HVC":2,"VOL":[{"VNM":"gpfs","VSZ":3288},{"VNM":"storage","VSZ":996916}]}]

Thanks

Tags (1)
0 Karma

stefandagerman
Path Finder

http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Spath#Examples

Have you tried spath path=HDD.HDID and it didn't work?

It should. and spath path=HDD.VOL.VNM should give you the third level element.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...