Getting Data In

What to do when json field conflicts with Splunk metadata?

pkeller
Contributor

A user is reporting that their indexed json data has a 'source' key that is being extracted.

"source": "[{label:'Tree'},{label:'two'},{label:'Three'}]",

When they search their data, they see:
alt text

They'd like the original source kept intact. Is there a transforms that I can add to my indexers to rename ONLY the json source?

The raw json looks like: [ snipped ]

"toggleMode":"click",
"_toggleMode": {
"desc": "Gets or sets user interaction used for expanding or collapsing any item.",
"type": "enum",
"keys": ["click","dblclick"],
"values": ["click","dblclick"]
},
*
"source": "[{label:'Tree'},{label:'two'},{label:'Three'}]",**
"_source": {
"desc": "Sets the initial contents. Easier to do at runtime.",
"type": "css",
"language": "JavaScript"
},*

Tags (2)

GauravSplunxter
Explorer

transforms.conf
[change_source]
REGEX = "source":\s"[(\S+)]
FORMAT = source::$1
DEST_KEY = MetaData:Source

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...