Getting Data In

Help with creating a regex that splits API data into better format than 1 big event?

vishalduttauk
Communicator

Hi all,

I am getting data in via an API (using the add on builder) but having  creating a regex which splits it into a better format rather than 1 big event. Here is an example of the event:

 

 

  "@odata.context": "https://example-app-env.aa01.aaa.aaaa-ad/odata/$metadata#Jobs",
  "@odata.count": 111,
  "value": [
    {
      "Key": "aaa1a111-aa11-11aa-a11a-11a1aa11a111",
      "StartTime": "2023-01-20T14:08:34.607Z",
      "EndTime": "2023-01-20T14:08:49.517Z",
      "State": "Successful",
      "JobPriority": "Normal",
      "Source": "Agent",
      "SourceType": "Agent",
      "BatchExecutionKey": "aaa1a111-aa11-11aa-a11a-11a1aa11a111",
      "Info": "Job completed",
      "CreationTime": "2023-01-20T14:08:34.607Z",
      "StartingScheduleId": null,
      "ReleaseName": "RobotProdLogin_DEV",
      "Type": "Attended",
      "InputArguments": "",
      "OutputArguments": "{}",
      "HostMachineName": "AAAAAAAA11111",
      "HasMediaRecorded": false,
      "PersistenceId": null,
      "ResumeVersion": null,
      "StopStrategy": null,
      "RuntimeType": "Development",
      "RequiresUserInteraction": true,
      "ReleaseVersionId": 1111,
      "EntryPointPath": null,
      "OrganizationUnitId": 1,
      "OrganizationUnitFullyQualifiedName": "Default",
      "Reference": "",
      "ProcessType": "Process",
      "ProfilingOptions": null,
      "ResumeOnSameContext": false,
      "LocalSystemAccount": "AAAAAA01\\AAA11AA",
      "OrchestratorUserIdentity": null,
      "Id": 00000
    },
    {
      "Key": "aaa1a111-aa11-11aa-a11a-11a1aa11a111",
      "StartTime": "2023-01-20T14:08:34.607Z",
      "EndTime": "2023-01-20T14:08:49.517Z",
      "State": "Successful",
      "JobPriority": "Normal",
      "Source": "Agent",
      "SourceType": "Agent",
      "BatchExecutionKey": "aaa1a111-aa11-11aa-a11a-11a1aa11a111",
      "Info": "Job completed",
      "CreationTime": "2023-01-20T14:08:34.607Z",
      "StartingScheduleId": null,
      "ReleaseName": "RobotProdLogin_DEV",
      "Type": "Attended",
      "InputArguments": "",
      "OutputArguments": "{}",
      "HostMachineName": "AAAAAAAA11111",
      "HasMediaRecorded": false,
      "PersistenceId": null,
      "ResumeVersion": null,
      "StopStrategy": null,
      "RuntimeType": "Development",
      "RequiresUserInteraction": true,
      "ReleaseVersionId": 1111,
      "EntryPointPath": null,
      "OrganizationUnitId": 1,
      "OrganizationUnitFullyQualifiedName": "Default",
      "Reference": "",
      "ProcessType": "Process",
      "ProfilingOptions": null,
      "ResumeOnSameContext": false,
      "LocalSystemAccount": "AAAAAA01\\AAA11AA",
      "OrchestratorUserIdentity": null,
      "Id": 00000
    },

 

How i want it to look.
Event 1

 

 "@odata.context": "https://example-app-env.aa01.aaa.aaaa-ad/odata/$metadata#Jobs",
  "@odata.count": 111,
  "value": [
    {

 

Event 2

 

    {
      "Key": "aaa1a111-aa11-11aa-a11a-11a1aa11a111",
      "StartTime": "2023-01-20T14:08:34.607Z",
      "EndTime": "2023-01-20T14:08:49.517Z",
      "State": "Successful",
      "JobPriority": "Normal",
      "Source": "Agent",
      "SourceType": "Agent",
      "BatchExecutionKey": "aaa1a111-aa11-11aa-a11a-11a1aa11a111",
      "Info": "Job completed",
      "CreationTime": "2023-01-20T14:08:34.607Z",
      "StartingScheduleId": null,
      "ReleaseName": "RobotProdLogin_DEV",
      "Type": "Attended",
      "InputArguments": "",
      "OutputArguments": "{}",
      "HostMachineName": "AAAAAAAA11111",
      "HasMediaRecorded": false,
      "PersistenceId": null,
      "ResumeVersion": null,
      "StopStrategy": null,
      "RuntimeType": "Development",
      "RequiresUserInteraction": true,
      "ReleaseVersionId": 1111,
      "EntryPointPath": null,
      "OrganizationUnitId": 1,
      "OrganizationUnitFullyQualifiedName": "Default",
      "Reference": "",
      "ProcessType": "Process",
      "ProfilingOptions": null,
      "ResumeOnSameContext": false,
      "LocalSystemAccount": "AAAAAA01\\AAA11AA",
      "OrchestratorUserIdentity": null,
      "Id": 00000
    },

 

 

Can you help?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @vishalduttauk,

please try this

(^\"|\{)

that you can test at https://regex101.com/r/VAaTET/1

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @vishalduttauk,

please try this

(^\"|\{)

that you can test at https://regex101.com/r/VAaTET/1

Ciao.

Giuseppe

vishalduttauk
Communicator

Thanks Giuseppe

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...