Hi,
I would like to assign fields to a delimited text file which does not contain a header.
Lets say an event or row of data looks like the following for a given source:
2343242| 234234cvf32:2345:5656556:-2000|abc-1|DOP|selected|list|{"anid":0,"vid":0,"name":"aname"}|04-03-2013|xyz
As you can see one of the values in the pipe delimited row is JSON, I would like to be able to refer to this data as a specific field and parse it as JSON.
What would be the best approach for this in Splunk?
Regards
D
This can be done I believe with the use of TRANSFORMS
First look at the REPORT directive from props.conf, which maps to a stanza in transforms.conf.
props.conf
[your sourcetype]
REPORT-blah = delim_split, json_split
transforms.conf
[delim_split]
DELIMS = "|{}"
FIELDS = your list of fields, one of them will contain the JSON string
[json_split]
DELIMS = ",",":"
Something like that should work. Sort of. Look at the docs.
/K
/K