Splunk Search

json Field value extraction

EvansB
Explorer

 

 

 

EvansB_1-1642651424459.png

I would like to get the list of those items in the properties field, like appName, levelId, etc.

 

 

Labels (1)
Tags (1)
0 Karma

EvansB
Explorer

Thank you guys, it worked!
What is the best option to correctly fix the JSON quote?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Fix it at source, i.e. get the application to do it properly in the first place! 😀

0 Karma

bowesmana
SplunkTrust
SplunkTrust

As it doesn't appear to be correctly quoted JSON, spath won't work, so try

| rex field=properties "appname.:.(?<appname>[^']*).*levelId.:[^\d]*(?<levelId>\d+)"

Not particularly robust, but should work in this example

 

ITWhisperer
SplunkTrust
SplunkTrust

As @bowesmana pointed out, it doesn't appear to be correctly quoted JSON, so you could fix that, then use spath

| eval properties=replace(properties,"'","\"")
| spath input=properties