Getting Data In

Can you help us parse the following JSON ?

saranya12
New Member

i have tried the spath command, but no results. I would like to display the below data into a table as shown below:

10:40:19.682 INFO  com.sample.splunk.service.splunkService - Splunk_SampleJson —>{“fileNamesList:[{“fileName”:”fileName1.zip"},{"fileName":"fileName2.zip”},{“fileName":"fileName3.zip”}]} I wanted to get data in table format 

FileName
——————
fileName1
fileName2
FileName3

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Thats probably because spath works on pure json data and your long entry is not pure json (it has those timestamps and other info before the json portion). You can extract the json portion into a new field and use spath on that, e.g.

your base search | rex "^([^\{]+)(?<jsondata>.+)$" | spath input=jsondata

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
|  eval _raw="10:40:19.682 INFO com.sample.splunk.service.splunkService - Splunk_SampleJson —>{\"fileNamesList:[{\"fileName\":\"fileName1.zip\"},{\"fileName\":\"fileName2.zip\"},{\"fileName\":\"fileName3.zip\"}]}"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex max_match=0 "\"fileName\":\"(?<fileName>[^\"]+)"
| table fileName
| mvexpand fileName

You may not need the last line (try with and without).

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Thats probably because spath works on pure json data and your long entry is not pure json (it has those timestamps and other info before the json portion). You can extract the json portion into a new field and use spath on that, e.g.

your base search | rex "^([^\{]+)(?<jsondata>.+)$" | spath input=jsondata
0 Karma

saranya12
New Member

Thank you worked for me , adding complete search query it might help some one

my base search | rex "^([^\{]+)(?<jsondata>.+)$" |spath input=jsondata output=fileName path=fileNamesList{}.fileName |table fileName
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Thanks for sharing your working search. Please remember to format your searches/code snippet by selecting the query and clicking on "101010" button on the top of the text area.

Please mark this question answered by accepting this as an answer.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...