Splunk Search

rex json field extraction

togmolodon
Explorer

Splunk newbie here.

I need to extract fields from our JSON logs, sample _raw output below:

2014-01-22 21:25:33,802 [xid=,fn=] INFO [pool-9-thread-1] tion.rts.RTSConsumer | Processing RTS JSON=RTSJsonEvent{value(m)='279732640,CardYellowHome,0104400000|279736050,CardYellowHome,0304000000|279738003,GoalHome,0404000000|279745927,GoalHome,0593900000', match id(t)='123456', type id(tp)='112', key(k)='CardYellowHome,No Player|CardYellowHome,No Player|GoalHome,No Player|GoalHome,No Player', parent id(p)='', id(i)='279746011', servertime='2014-01-23 02:25:33.619'}

I want the output in table format wherein it contains the values for match id, type id, key, parent id, id, and server time.

Thanks for the help.

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi togmolodon,

no need to extract fields by rex, just use the spath search command on your JSON logs and you're ready to build your table. See example #3 in the docs about spath.

hope this helps ...

cheers, MuS

0 Karma

togmolodon
Explorer

My head seemed out of whacked lately, I can't even make the rename function to work. I started out with the following:

host="172.16.1.1" "Processing RTS JSON=" | spath | rename RTSJsonEvent.value{1}{@value} AS "Game Timer" | table "Game Timer"

The above did not return any.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...