Splunk Search

How to create the proper search to extract all of the fields and their respective field_values from the sample data?

Strangertinz
Path Finder

Hi Splunkers!


Any one able to assist me with a search that I am trying to create below. 

I want to extract some data from multiple json data value fields. I am able to ingest the json data and extract the fields and values correctly.  Sample data below 


{

"key1": "value1",

"key2": "[field1 = field_value1] [field2 = field_value2] [field3 = field_value3] [field4 = field_value4]",

"key3": "value3",

"key4": "[field5 = field_value5] [field6 = field_value6] "
}


I am trying to create the proper search to extract all of the fields and their respective field_values from the sample data above.


Thanks in advance! 

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming this is an accurate representation of your events, try something like this

| rex max_match=0 field=key2 "\[(?<kvpair2>\S+\s=\s[^\]]+)\]"
| rex max_match=0 field=key4 "\[(?<kvpair4>\S+\s=\s[^\]]+)\]"
| eval kvpairs=mvappend(kvpair2, kvpair4)
| mvexpand kvpairs
| rex field=kvpairs "(?<key>\S+)\s=\s(?<value>.+)
| eval {key}=value

View solution in original post

0 Karma

Strangertinz
Path Finder

Awesome! Thanks for assisting with the search! ITWhisperer for president! 

0 Karma

Strangertinz
Path Finder

Thanks for the prompt and excellent response! 

my apologies for not including this earlier... but what if the json data is nested like the example below?

I would still like to extract field and field values 

{

"key1": "value1",

"key2":  { "key2_key1": "key2_key1_value1",
                   "key2_key2": "key2_key2_value2",
                    "key2_key3" : "[field1 = field_value1] [field2 = field_value2] [field3 = field_value3] [field4 = field_value4]" }

}

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| spath
| rex max_match=0 field=key2.key2_key3 "\[(?<kvpairs>\S+\s=\s[^\]]+)\]"
| mvexpand kvpairs
| rex field=kvpairs "(?<key>\S+)\s=\s(?<value>.+)
| eval {key}=value
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming this is an accurate representation of your events, try something like this

| rex max_match=0 field=key2 "\[(?<kvpair2>\S+\s=\s[^\]]+)\]"
| rex max_match=0 field=key4 "\[(?<kvpair4>\S+\s=\s[^\]]+)\]"
| eval kvpairs=mvappend(kvpair2, kvpair4)
| mvexpand kvpairs
| rex field=kvpairs "(?<key>\S+)\s=\s(?<value>.+)
| eval {key}=value
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...