Getting Data In

Can you help us parse the following JSON ?

saranya12
New Member

i have tried the spath command, but no results. I would like to display the below data into a table as shown below:

10:40:19.682 INFO  com.sample.splunk.service.splunkService - Splunk_SampleJson —>{“fileNamesList:[{“fileName”:”fileName1.zip"},{"fileName":"fileName2.zip”},{“fileName":"fileName3.zip”}]} I wanted to get data in table format 

FileName
——————
fileName1
fileName2
FileName3

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Thats probably because spath works on pure json data and your long entry is not pure json (it has those timestamps and other info before the json portion). You can extract the json portion into a new field and use spath on that, e.g.

your base search | rex "^([^\{]+)(?<jsondata>.+)$" | spath input=jsondata

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
|  eval _raw="10:40:19.682 INFO com.sample.splunk.service.splunkService - Splunk_SampleJson —>{\"fileNamesList:[{\"fileName\":\"fileName1.zip\"},{\"fileName\":\"fileName2.zip\"},{\"fileName\":\"fileName3.zip\"}]}"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex max_match=0 "\"fileName\":\"(?<fileName>[^\"]+)"
| table fileName
| mvexpand fileName

You may not need the last line (try with and without).

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Thats probably because spath works on pure json data and your long entry is not pure json (it has those timestamps and other info before the json portion). You can extract the json portion into a new field and use spath on that, e.g.

your base search | rex "^([^\{]+)(?<jsondata>.+)$" | spath input=jsondata
0 Karma

saranya12
New Member

Thank you worked for me , adding complete search query it might help some one

my base search | rex "^([^\{]+)(?<jsondata>.+)$" |spath input=jsondata output=fileName path=fileNamesList{}.fileName |table fileName
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Thanks for sharing your working search. Please remember to format your searches/code snippet by selecting the query and clicking on "101010" button on the top of the text area.

Please mark this question answered by accepting this as an answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...