Getting Data In

How to log JSON to Splunk and optimize for spath?

thomasreggi
New Member

I am looking to reformat my log output. Right now it's pretty messy and does not follow Splunks parsing format.

What I would like to do is only log a JSON object a string, something like this:

{"time":"2018-01-26 08:17:22.387","uuid":"13hiuh312-213e-134j-sdasj-dsadqweq","file":"main","fn":"load","message":"Hello World"}

Or with a nested "Person" JSON object.

{"time":"2018-01-26 08:17:22.387","uuid":"13hiuh312-213e-134j-sdasj-dsadqweq","file":"main","fn":"load","person":{"name": "thomas reggi", "age":"30"}}

I found in the "Logging best practices" Page that it fields should be all caps and quoted in a totally different format. So I am interested in making the following change.

TIME="2018-01-26 08:17:22.387", UUID="13hiuh312-213e-134j-sdasj-dsadqweq", FILE="main", FN="load", MESSAGE="Hello World"

Or

TIME="2018-01-26 08:17:22.387", UUID="13hiuh312-213e-134j-sdasj-dsadqweq", FILE="main", FN="load", PERSON={"name":"thomas reggi","age":"30"}

I am curious if I need to have the PERSON JSON object at the enclosed in quotes, and if this is valid.

0 Karma

niketn
Legend

@thomasreggi which "Logging best practices" are you referring too? Can you add detail/link? Is this with respect to the application generating above JSON or Splunk? I think Splunk has no issues with field names in upper case or lower case. Field names should ideally not start with digits or special characters.

Also for the JSON itself to be valid for spath to work automatically, you should have field names also in double quotes as in your first sample JSON. Following is the run anywhere search:

| makeresults 
| eval _raw="{\"TIME\":\"2018-01-26 08:17:22.387\",\"UUID\":\"13hiuh312-213e-134j-sdasj-dsadqweq\",\"FILE\":\"main\",\"FN\":\"load\",\"PERSON\":{\"NAME\": \"thomas reggi\", \"AGE\":\"30\"}}"
| spath
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

thomasreggi
New Member
0 Karma

mayurr98
Super Champion

hey i do not think it is a best pratice, rather it would make your search terrible when you want to search for something
Try this run anywhere search

| makeresults | eval raw="{\"time\":\"2018-01-26 08:17:22.387\",\"uuid\":\"13hiuh312-213e-134j-sdasj-dsadqweq\",\"file\":\"main\",\"fn\":\"load\",\"person\":{\"name\": \"thomas reggi\", \"age\":\"30\"}}" | spath input=raw | search fn=load | eval ss="\"load\""  | eval test="load" | search test="load"

suppose if fn="load" then you can not write |search fn=load..if fn=load then you can write both fn=load OR fn="load"

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...