Getting Data In

Parsing JSON syslog data - additional fields extraction happening.

seshagirik545
New Member

Hi All,

need help in parsing below JSON message.

{ "MsgDesc": "1229340728.000000:iso.3.6.1.4.1.9.9.96.1.1.1.1.2.567777 = INTEGER: 1 iso.3.6.1.4.1.9.9.96.1.1.1.1.3.345455 = INTEGER: 3 iso.3.6.1.4.1.9.9.96.1.1.1.1.4.345435 = INTEGER: 1 iso.3.6.1.4.1.9.9.96.1.1.1.1.5.111249171 = IpAddress: 192.168.1.100 iso.3.6.1.4.1.9.9.", "MsgType": "SNMPD-3-ERROR", "Severity": 3}

props for this sourcetype are in HF ( Splunk version 7.3.0 😞

pulldown_type = true
category = Structured
KV_MODE = none
AUTO_KV_JSON = false
INDEXED_EXTRACTIONS= json
SHOULD_LINEMERGE = false

The problem is along with the MsgDesc, MsgType & Severity, Splunk extracting iso.3.6.1.4.1.9.9.96.1.1.1.1.2.567777, iso.3.6.1.4.1.9.9.96.1.1.1.1.3.345455 also. from the MsgDesc value. I dont want these extra fields. Is there a way solve this?

Thanks,
Seshu

0 Karma

jkat54
SplunkTrust
SplunkTrust

That's because splunk is also auto extracting the Key value Pairs (this=that), most likely because you are in verbose mode while searching. Your KV_MODE=none should fix that but it has to be set on your search heads not the forwarder.

Also INDEXED_EXTRACTIONS=JSON should be all uppercase and it should be on the first forwarder that "sees" the data (UF or HF).

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...