Getting Data In

Is there a way to use kv_mode=json and eliminate one level in spath?

dominiquevocat
Motivator

Is there a way to use kv_mode=json and remove levels of nesting during indexing or later?

Example: we jave some json (jboss) that looks like this:

{
    "outcome" : "success",
    "result" : {
        "name" : "32740@chhs-ssys060",
        "vm-name" : "Java HotSpot(TM) 64-Bit Server VM",
        "vm-vendor" : "Sun Microsystems Inc.",
        "vm-version" : "20.60-b01",
        "spec-name" : "Java Virtual Machine Specification",
        "spec-vendor" : "Sun Microsystems Inc.",
        "spec-version" : "1.0",

resulting in fields that are named result.name, result.vm-version etc.
My goal is to remove the top level node "result" so the fields names are "cleaner" i.e. name, vm-version.

It is a somewhat narrow usecase because all results i want are in the node "result". If it is not too taxing one could probably do a eval on any result.* field and rename it during search time to *? what would be the best way to do so? Is there a easy option for the spath or kv_mode=json that i overlooked?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The simplest solution would be to configure field alias on your search head to rename all result.FieldName to just FieldName. A sample props.conf for the same would be like this

props.conf on Search Head

[Your sourcetype]
...other configurations...
FIELDALIAS-result = result.* as *

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The simplest solution would be to configure field alias on your search head to rename all result.FieldName to just FieldName. A sample props.conf for the same would be like this

props.conf on Search Head

[Your sourcetype]
...other configurations...
FIELDALIAS-result = result.* as *

dominiquevocat
Motivator

looks good, think its no performance penalty.
Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...