×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
mchennam
Engager
Member since: ‎04-08-2021
‎04-09-2021
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-08-2021
Activity Feed
Topics I've Started
View All

Re: Extract JSON Data

by in Splunk Search
‎04-09-2021 08:22 AM
‎04-09-2021 08:22 AM
Thanks for your time. I am sorry for not being clear on what i need. The log file contains json strings. I am trying to identify the rows containing empty 'tags:{}'  attribute.  And then show the extracted fields in a table. The following is what i have come up with so far.  Not sure if this is a efficient way to query thousand of records.  index=xxx sourcetype="aws:config"  "\"tags\": {}"  | table ARN, aws_account_id, awsRegion, availabilityZone, resourceId, resourceCreationTime, configurationItemStatus, configurationItemCaptureTime   ARN aws_account_id awsRegion availabilityZone resourceId resourceCreationTime configurationItemStatus configurationItemCaptureTime arn:aws:ec2:us-east-1:23233232:instance/i-02d7ce4ac0daa3a94 23232323 us-east-1 us-east-1a i-232323232323 2021-04-09T13:00:16.000Z ResourceDiscovered 2021-04-09T13:01:58.577Z ... View more

Extract JSON Data

by in Splunk Search
‎04-08-2021 06:04 PM
‎04-08-2021 06:04 PM
Need help to find a way to search JSON strings where an attributes is empty. Ex:  get all JSON data where 'tags' is empty.   Appreciate your help.   { "configurationItemCaptureTime":"2021-04-09T00:40:20.800Z", "relationships":[ ], "configurationStateId":3456, "configurationItemVersion":"1.3", "tags":{ }, "awsAccountId":"12345678", "supplementaryConfiguration":{ }, "ARN":"arn:aws:ec2:us-east-1:4567:instance/i-0b8973444340", "configurationStateMd5Hash":"", "awsRegion":"us-east-1", "resourceId":"i-0343434345b26510", "configurationItemStatus":"ResourceDeleted", "resourceType":"AWS::EC2::Instance", "relatedEvents":[ ] }           ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎04-09-2021 11:36 PM