Getting Data In

Can you help me get multiple fields from a single field in JSON?

danw25
Engager

The text field in my event contains A LOT of data.

json snipped :

{"Date":"2018-12-05T12:04:04.71","ID":"00000000-0000-0000-0000-000000000000","Text":"*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***} 

What i'm trying to do is write a search that will get all values of on/all fields.

i.e. "get all values of userCount"

i have had some progress using eval and split

eval values=split(Text," * ") |
eval temp=mvindex(values,0)|
eval temp=split(temp,"=")|eval temp=mvindex(temp,1)|convert rmunit(temp)|    
eval normalSliceUsage=temp| table Date normalSliceUsage
0 Karma

sdchakraborty
Contributor

Hi,

Can you try the below search, the idea is to create those fields using rex.

index=<your index>
|  rex field=Text normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)

you can checkout the how the rex working in the below site,

https://regex101.com/

in the test string give the below,

*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***

in the regex give the below regex,

 normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)
0 Karma

prakash007
Builder

I guess Splunk should auto-extract field values when they are in foo=bar format, check your interesting fields for userCount, if not pls post a snippet of your json data.

0 Karma

whrg
Motivator

Does one event in Splunk contain multiple lines of text or only one line?
When you search for your events in Splunk, is the field "userCount" available on the left side?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...