Splunk newbie here.
I need to extract fields from our JSON logs, sample _raw output below:
2014-01-22 21:25:33,802 [xid=,fn=] INFO [pool-9-thread-1] tion.rts.RTSConsumer | Processing RTS JSON=RTSJsonEvent{value(m)='279732640,CardYellowHome,0104400000|279736050,CardYellowHome,0304000000|279738003,GoalHome,0404000000|279745927,GoalHome,0593900000', match id(t)='123456', type id(tp)='112', key(k)='CardYellowHome,No Player|CardYellowHome,No Player|GoalHome,No Player|GoalHome,No Player', parent id(p)='', id(i)='279746011', servertime='2014-01-23 02:25:33.619'}
I want the output in table format wherein it contains the values for match id, type id, key, parent id, id, and server time.
Thanks for the help.
Hi togmolodon,
no need to extract fields by rex, just use the spath search command on your JSON logs and you're ready to build your table. See example #3 in the docs about spath.
hope this helps ...
cheers, MuS
My head seemed out of whacked lately, I can't even make the rename function to work. I started out with the following:
host="172.16.1.1" "Processing RTS JSON=" | spath | rename RTSJsonEvent.value{1}{@value} AS "Game Timer" | table "Game Timer"
The above did not return any.