Getting Data In

Need to remove prefix from json array.

vin02ptl
Explorer

Need to remove prefix from json array. I want to remove everything before {"id"

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#auditLogs/directoryAudits","value":[{"id"

Tags (1)
0 Karma

to4kawa
Ultra Champion

props.conf

[odata]
CHARSET=UTF-8
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTION = none
KV_MODE = json
LINE_BREAKER = (.*:\[){\"id|}(,)|(\]})
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
disabled = false

please modify DATETIME_CONFIG

If you don't present your log properly(you should use code sample), you can't expect a response.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vin02ptl,
please, could you share an example of your logs?
Anyway, I solved this problem with this regex:

| rex "[^\{]*(?<all>.*)"

Ciao.
Giuseppe

0 Karma

vin02ptl
Explorer

@gcusello please have a look and advice

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vin02ptl,
Thy this regex

\"id\":\"(?<id>[^\"]+)\",\"category\":\"(?<category>[^\"]+)\",\"correlationId\":(?<correlationId>[^\"]+),\"activityDateTime\":\"(?<activityDateTime>[^\"]+)

that you can test at https://regex101.com/r/StogWZ/1

Ciao.
Giuseppe

0 Karma

vin02ptl
Explorer

i just want to remove header part during indexing remaining parsing field regex i can write....

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...