i have tried the spath command, but no results. I would like to display the below data into a table as shown below:
10:40:19.682 INFO com.sample.splunk.service.splunkService - Splunk_SampleJson —>{“fileNamesList:[{“fileName”:”fileName1.zip"},{"fileName":"fileName2.zip”},{“fileName":"fileName3.zip”}]} I wanted to get data in table format
FileName
——————
fileName1
fileName2
FileName3
Thats probably because spath works on pure json data and your long entry is not pure json (it has those timestamps and other info before the json portion). You can extract the json portion into a new field and use spath on that, e.g.
your base search | rex "^([^\{]+)(?<jsondata>.+)$" | spath input=jsondata
Like this:
| makeresults
| eval _raw="10:40:19.682 INFO com.sample.splunk.service.splunkService - Splunk_SampleJson —>{\"fileNamesList:[{\"fileName\":\"fileName1.zip\"},{\"fileName\":\"fileName2.zip\"},{\"fileName\":\"fileName3.zip\"}]}"
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| rex max_match=0 "\"fileName\":\"(?<fileName>[^\"]+)"
| table fileName
| mvexpand fileName
You may not need the last line (try with and without).
Thats probably because spath works on pure json data and your long entry is not pure json (it has those timestamps and other info before the json portion). You can extract the json portion into a new field and use spath on that, e.g.
your base search | rex "^([^\{]+)(?<jsondata>.+)$" | spath input=jsondata
Thank you worked for me , adding complete search query it might help some one
my base search | rex "^([^\{]+)(?<jsondata>.+)$" |spath input=jsondata output=fileName path=fileNamesList{}.fileName |table fileName
Thanks for sharing your working search. Please remember to format your searches/code snippet by selecting the query and clicking on "101010" button on the top of the text area.
Please mark this question answered by accepting this as an answer.