Hi, I've a JSON object logged into splunk in double quotes. What to do to extract the JSON object using spath. How do I ignore the double quotes before doing the spath.
2016-01-20 17:40:38,076 INFO org.apache.log4j.Logger transaction_id="1234565"
Json_object = "{
"requestId": "123",
"partnerId": "asd",
"date":"01/01/2015 14:00:00"
}"
tmepId ="123"
Thanks.
Hi,
here you go. The important bit is the line with the rex command. The rest of it I just used to simulate the event and present the result.
|stats count|eval count="2016-01-20 17:40:38,076 INFO org.apache.log4j.Logger transaction_id=\"1234565\"
Json_object = \"{
\"requestId\": \"123\",
\"partnerId\": \"asd\",
\"date\":\"01/01/2015 14:00:00\"
}\"
tmepId =\"123\""|
rex field=count "(?s)\"(?{.*})\""
|table count myjson|spath input=myjson
BR
Oliver
Hi,
here you go. The important bit is the line with the rex command. The rest of it I just used to simulate the event and present the result.
|stats count|eval count="2016-01-20 17:40:38,076 INFO org.apache.log4j.Logger transaction_id=\"1234565\"
Json_object = \"{
\"requestId\": \"123\",
\"partnerId\": \"asd\",
\"date\":\"01/01/2015 14:00:00\"
}\"
tmepId =\"123\""|
rex field=count "(?s)\"(?{.*})\""
|table count myjson|spath input=myjson
BR
Oliver
Thanks Oliver. That worked:)
Very Welcome. 🙂