Getting Data In

Can you help me get multiple fields from a single field in JSON?

danw25
Engager

The text field in my event contains A LOT of data.

json snipped :

{"Date":"2018-12-05T12:04:04.71","ID":"00000000-0000-0000-0000-000000000000","Text":"*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***} 

What i'm trying to do is write a search that will get all values of on/all fields.

i.e. "get all values of userCount"

i have had some progress using eval and split

eval values=split(Text," * ") |
eval temp=mvindex(values,0)|
eval temp=split(temp,"=")|eval temp=mvindex(temp,1)|convert rmunit(temp)|    
eval normalSliceUsage=temp| table Date normalSliceUsage
0 Karma

sdchakraborty
Contributor

Hi,

Can you try the below search, the idea is to create those fields using rex.

index=<your index>
|  rex field=Text normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)

you can checkout the how the rex working in the below site,

https://regex101.com/

in the test string give the below,

*** Environment changed due to [Average CPU ] : normalSliceUsage=0.00% * totalWeightUsage=0.00 * userCount=0 * clinicalUserCount=0 * AvgCPUUsage=9.97% * AvailableMemory=6458MB ***

in the regex give the below regex,

 normalSliceUsage=(?<normalSliceUsage>\d+\.\d+%)\s+\*\s+totalWeightUsage=(?<totalWeightUsage>\d\.\d{2})\s+\*\s+userCount=(?<userCount>\d+)\s+\*\s+clinicalUserCount=(?<clinicalUserCount>\d+)\s+\*\s+AvgCPUUsage=(?<AvgCPUUsage>\d+\.\d+%)\s+\*\s+AvailableMemory=(?<AvailableMemory>\d+MB)
0 Karma

prakash007
Builder

I guess Splunk should auto-extract field values when they are in foo=bar format, check your interesting fields for userCount, if not pls post a snippet of your json data.

0 Karma

whrg
Motivator

Does one event in Splunk contain multiple lines of text or only one line?
When you search for your events in Splunk, is the field "userCount" available on the left side?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...