Splunk Search

Field alias or batch renaming with wildcard

mdsnmss
SplunkTrust
SplunkTrust

So I have a JSON source that is creating array values but I am looking to get rid of a number of nested fields and make them primary. Coming in I have many fields that appear docs{}.. Using | rename docs{}.* as * at search time produces the desired results but would like a backend props/transforms solution that performs the same function. I have tried FIELDALIAS-json = docs{}.* AS * but it produces no different results. Are wildcards supported by fieldalias?

These are changing fields that I am unsure of all possible values so would like to dynamically change them to drop the specified prefix for each field. If fieldalias is not possible is there another solution possibly using REPORT and transforms? The array structure of the log appears as:

"docs":[{"<field1>":<value1>,"<field2>":"<value2>",...etc.}]
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

AFAIK, wild cards are not supported in FIELDALIAS attribute. Try this REPORT method

props.conf

[yourSourceType]
REPORT-extractjsonfields = extract_json_fields

transforms.conf

[extract_json_fields]
REGEX = \"([^\"]+)\"=\"([^\"]+)\"
FORMAT = $1::$2
REPEAT_MATCH = true

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

AFAIK, wild cards are not supported in FIELDALIAS attribute. Try this REPORT method

props.conf

[yourSourceType]
REPORT-extractjsonfields = extract_json_fields

transforms.conf

[extract_json_fields]
REGEX = \"([^\"]+)\"=\"([^\"]+)\"
FORMAT = $1::$2
REPEAT_MATCH = true
0 Karma

mdsnmss
SplunkTrust
SplunkTrust

I should note that it is set with INDEXED_EXTRACTIONS = json so these values are all already extracted. I'd like to change them at search time. It looks like within the array the field values can have quotes or not and seems dependent on whether or not it is a string or number.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about this?

REGEX = \"([^\"]+)\"=\"*([^\"]+|[0-9\.]+)\"*
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...