Getting Data In

Parsing JSON with spath command is not returning expected results.

jbutorac3
New Member

I have tried to get after.merchantId a million different ways, but it always comes back blank. I believe I'm missing the obvious:

Search String:
sourcetype="json" auditId=RECIPIENT_ADDED | spath | table _time, after.merchantId
...only _time has values, nothing else

sourcetype="json" auditId=RECIPIENT_ADDED | spath | rename after.merchantId as merchantId, after.leadDays as leadDays | eval x=mvzip(merchantId,leadDays) | table _time,merchantId,leadDays,x
...only _time has values, nothing else


Sample JSON:
{   
     @timestamp:     2018-09-09T19:05:50.077Z   
     @version:   1  
     actingProfileType:  ALL    
     after:  {"phoneNumber":"8005551212","recipientNumber":"************1111","merchantId":"111111112","paperPaymentEnabled":"true","leadDays":"5","Nickname":"Bob Evans","addressOnFile":"false","recipientName":"Bobby Evans","transferMethod":"PAYMENT","merchantZipRequired":"false","providerStatus":"ACTIVE","merchantName":"Bobby Evans"}    
     application:    BACKOFFICE 
     auditId:    RECIPIENT_ADDED    
     browserName:    Chrome 
     browserVersion:     68.0.3440.106  
     clientIp:   192.0.0.1  
     companyId:  11113  
     component:  PAYMENTS   
     instanceId:     1abc2345-67de      
     userId:     11111114   
     userSourceId:   2fgh3456-89ij      
}
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) Your JSON is missing required commas between key-value pairs.

2) The colons in the time field are confusing the parsing algorithm. In addition, it seems to be breaking each value and inserting space before periods, between pure alpha, pure decimal, and hyphens, and so on.

3) Parsing worked perfectly when we added the required commas and surrounded all keys and values with quotes, but beyond that, we couldn't tell you what other issues there might have been.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The spath command works when your json data is in pure json format. You can use https://jsonlint.com/ to confirm if you raw data is a valid json.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...