How to extract fields from json attributes?

[sergimola]

I am sending some traces from my service to Splunk using the OpenTelemetry Collector and the Splunk HEC exporter.

My traces are getting to Splunk and their fields in general properly identified, but I would like for the attributes of an event that have a json format to be further decomposed into fields.

This is an example of an event:

sergimola_0-1676983025324.png

I would like for the `attributes.data` field to be further decomposed.

Is that possible?

[sergimola]

I've looked into `spath`, but I think there's something else on top of that.

It works for the event itself wich is a json event, but onf the the properties inside this json event is also a json structure.

sergimola_0-1676988428602.png

Using this works fine:

| spath output=data path=attributes.data

But if I want to create a field out of the `Number` property in `attributes.data` that doesn't work

| spath output=data_number path=attributes.data.Number

[ITWhisperer · Accepted solution]

| spath output=data path=attributes.data
| spath input=data

[sergimola]

Oh, nice, this works!

Thanks.

[richgalloway]

Use the spath command in your search query to extract fields from JSON events.

[ITWhisperer]

You can use spath in your search SPL to extract fields from JSON data.