Hi All,
need help in parsing below JSON message.
{ "MsgDesc": "1229340728.000000:iso.3.6.1.4.1.9.9.96.1.1.1.1.2.567777 = INTEGER: 1 iso.3.6.1.4.1.9.9.96.1.1.1.1.3.345455 = INTEGER: 3 iso.3.6.1.4.1.9.9.96.1.1.1.1.4.345435 = INTEGER: 1 iso.3.6.1.4.1.9.9.96.1.1.1.1.5.111249171 = IpAddress: 192.168.1.100 iso.3.6.1.4.1.9.9.", "MsgType": "SNMPD-3-ERROR", "Severity": 3}
props for this sourcetype are in HF ( Splunk version 7.3.0 😞
pulldown_type = true
category = Structured
KV_MODE = none
AUTO_KV_JSON = false
INDEXED_EXTRACTIONS= json
SHOULD_LINEMERGE = false
The problem is along with the MsgDesc, MsgType & Severity, Splunk extracting iso.3.6.1.4.1.9.9.96.1.1.1.1.2.567777, iso.3.6.1.4.1.9.9.96.1.1.1.1.3.345455 also. from the MsgDesc value. I dont want these extra fields. Is there a way solve this?
Thanks,
Seshu
... View more
