×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
jayita1989
Loves-to-Learn Lots
Member since: ‎04-09-2024
‎05-10-2024
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-09-2024
Activity Feed
View All

Re: How to extract fields from nested json

by in Splunk Search
‎05-10-2024 01:30 AM
‎05-10-2024 01:30 AM
Hello, This is the configuration that we have in the search head TA props.conf [ sourcetype] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 TIME_FORMAT=%Y-%m-%dT%H:%M:%SZ TIME_PREFIX=eventTime\\\"\:\\\" EVENT_BREAKER=([\r\n]+) TRUNCATE=0 MAX_TIMESTAMP_LOOKAHEAD=30 EVENT_BREAKER_ENABLE=true KV_MODE=json ... View more

Re: How to extract fields from nested json

by in Splunk Search
‎05-10-2024 01:12 AM
‎05-10-2024 01:12 AM
Hello, Thanks for your reply. We already have tested putting this in the props.conf of our search head TA, but this also did not extract the event fields further. Reg the splunkbase TA, I am not sure on this. May be I can give it a check. ... View more

Re: How to extract fields from nested json

by in Splunk Search
‎05-10-2024 01:10 AM
‎05-10-2024 01:10 AM
Hello, Thanks for your response. I have tried your suggestion on the search head but unfortunately it did not extract the "event" field further.   ... View more

How to extract fields from nested json

by in Splunk Search
‎05-07-2024 03:45 AM
‎05-07-2024 03:45 AM
Hello, Can someone please help me in extracting nested json fields without regex? I have tried below: 1. Updating KV_mode =json in the search head TA props.conf 2. Updating indexed_extractions=JSON in the search head TA props.conf 3. Updating the limits.conf with the spath stanza for the HF TA [spath] extraction_cutoff = 10000 4. Tried mvexpand command also.  Nothing worked. My raw logs looks like this: event": "{\"eventVersion\"😕"1.08\",\"userIdentity\":{\"type\"😕"AssumedRole\",\"principalId\"😕"AROAXYKJUXCU7M4FXD7ZZ:redlock\",\"arn\"😕"arn:aws:sts::533267265705:assumed-role/PrismaCloudRole-804603675133320192/redlock\",\"accountId\"😕"533267265705\",\"accessKeyId\"😕"ASIAXYKJUXCUSTP25SUE\",\"sessionContext\":{\"sessionIssuer\":{\"type\"😕"Role\",\"principalId\"😕"AROAXYKJUXCU7M4FXD7ZZ\",\"arn\"😕"arn:aws:iam::533267265705:role/PrismaCloudRole-804603675133320192\",\"accountId\"😕"533267265705\",\"userName\"😕"PrismaCloudRole-804603675133320192\"},\"webIdFederationData\":{},\"attributes\":{\"creationDate\"😕"2024-05-03T00:53:45Z\",\"mfaAuthenticated\"😕"false\"}}},\"eventTime\"😕"2024-05-03T04:09:07Z\",\"eventSource\"😕"autoscaling.amazonaws.com\",\"eventName\"😕"DescribeScalingPolicies\",\"awsRegion\"😕"us-west-2\",\"sourceIPAddress\"😕"13.52.105.217\",\"userAgent\"😕"Vert.x-WebClient/4.4.6\",\"requestParameters\":{\"maxResults\":10,\"serviceNamespace\"😕"cassandra\"},\"responseElements\":null,\"additionalEventData\":{\"service\"😕"application-autoscaling\"},\"requestID\"😕"ef12925d-0e9a-4913-8da5-1022cfd15964\",\"eventID\"😕"a1799eeb-1323-46b6-a964-efd9b2c30a8a\",\"readOnly\":true,\"eventType\"😕"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\"😕"533267265705\",\"eventCategory\"😕"Management\",\"tlsDetails\":{\"tlsVersion\"😕"TLSv1.3\",\"cipherSuite\"😕"TLS_AES_128_GCM_SHA256\",\"clientProvidedHostHeader\"😕"application-autoscaling.us-west-2.amazonaws.com\"}}"} ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎05-10-2024 05:45 AM