Splunk Search

How to extract badly formatted JSON?

markangeltruema
Engager

Hi

I'm trying to extract some json values into tables for a dashboard. The log line that i'm using is something like the below

 

 

 

 username=myUser notificationPreferences=
[class NotificationPreferences { category=cat1, categoryDescription=category1  receiveEmailNotifications=false receiveSmsNotifications=false }, 
class NotificationPreferences { category=cat2 categoryDescription=category2 receiveEmailNotifications=false receiveSmsNotifications=true  }] 

 

 

 

 

As you can see, its just a standard toString on a java class that the developers are outputting. What i want is a table of users and categories, with each category having the associated details, eg

User Category Email SMS
myUser1 Category1 false false
myUser1 Category2 false true
myUser2 Category1 true true

 

I started by trying to tidy up the json 

 

 

 

| rex field=notificationPreferences mode=sed "s/\[class NotificationPreferences/prefs:[ /g"
| rex field=notificationPreferences mode=sed "s/, class NotificationPreferences/, /g"

 

 

 

Which makes the notificationPreferences field a bit better

 

 

 

 username=myUser notificationPreferences=
prefs:[ { category=cat1, categoryDescription=category1  receiveEmailNotifications=false receiveSmsNotifications=false },{ category=cat2 categoryDescription=category2 receiveEmailNotifications=false receiveSmsNotifications=true  }] 

 

 

 

But from here im struggling with what i need to do in terms of spath and extractions to get both categories to work. I only ever seem to get the first category to appear in my results.

Any help would be great

Thanks

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that the example string is so far from properly formatted JSON, you could try something like this

| makeresults 
| eval _raw=" username=myUser notificationPreferences=
[class NotificationPreferences { category=cat1, categoryDescription=category1  receiveEmailNotifications=false receiveSmsNotifications=false }, 
class NotificationPreferences { category=cat2 categoryDescription=category2 receiveEmailNotifications=false receiveSmsNotifications=true  }] "
``` Lines above just set up your sample data ```
| rex "(?ms)notificationPreferences=\s*\[(?<preferences>.*?)\]"
| rex field=preferences max_match=0 "class NotificationPreferences \{\s?(?<preference>.*?)\s?\}"
| mvexpand preference
| rename _raw as orig_raw
| rename preference as _raw
| extract pairdelim=", " kvdelim="="
| rename _raw as preference
| rename orig_raw as _raw
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...