I have perfect key/value pairs in my log (I am using the Splunk Add-on for Microsoft Azure to get table storage logs). The logs have:
LogTyppe: LogTyppe
MessageDetail: {"test"="this will work", "name"="value", "name1"="value1", "name2"="value2"}
MessageSummary: MessageSummary
NetworkAddress: NetworkAddress
Notice in MessageDetail there is a JSON formatted string... How do I get Splunk to recognize that one of the field values as json format?
Hi, @ brent_weaver, please update the title and question and avoid saying the event is json. Otherwise, people misunderstand this question itself.
{"test"="this will work", "name"="value", "name1"="value1", "name2"="value2"}
This is not json format???
Assuming you have json format value for MessageDetail field,
<your search> | spath input=MessageDetail
http://json.org/example.html is an example of what JSON data actually looks like, the above is key=value which is not JSON...
using spath in verbose mode?
THANK YOU for the answer. Let me ask a little bit differently, how do I get this field to be treated as interesting fields?
Sorry but I do not understand your question.
Also, instead of creating a new answer, can you add comment to an existing answer or, update your question as more elaborated question?
I'm still trying to understand your question especially your word "this field" above. Maybe it is because I do not understand Azure event contents.
Assuming you want to have Key-Value field extraction for any format of "key"="value" string, you can achieve it in transforms.conf and props.conf.
Note: I'm assuming sourcetype is azure_test in this example.
- props.conf
[azure_test]
REPORT-extract_kv = extact_kv
- transforms.conf
[extract_kv]
REGEX = "(?<_KEY_1>[^\"]+)"="(?<_VAL_1>[^\"]+)"
Of course using this idea, you can do more specific for only for certain field value, etc.