Getting Data In

How to parse/index only json entry from raw data which are in non-uniform pattern?

Boopalan
New Member

How to parse/index only json entry from raw data which are in non-uniform pattern?

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw=" <BOR>
  ExSrc:Schwab.Client.Fx^
  URL:null^
  LogMsg:{\"actor\":{\"Cust\":null,\"Acct\":null,\"Rep\":null,\"System\":null},\"header\":{\"AppId\":null,\"RecId\":\"null\",\"Ver\":\"\",\"StartTS\":\"null\"},\"source\":{\"Ip\":\"*\",\"MacAddress\":null,\"SRCOS\":\"null\",\"SRCRuntime\":null,\"SRCAppName\":null,\"SRCAppVersion\":null,\"SRCReqId\":\"null\",\"CorrelationId\":\"null\",\"SourceId\":null,\"Uri\":\"null\"}}^
  ExType:Common.Exceptions.ServiceCommunicationException^
  <EOR>" 
| rex "(?<json>(?={).+})" 
| spath input=json 
| table actor* header* source*

Extracting in search, like this.

0 Karma

Boopalan
New Member

Is there anyway to make this possible through configuration changes while parsing/indexing the log file itself

0 Karma

to4kawa
Ultra Champion

sorry, I can't. please ask others.
please tell me why do you want while parsing/indexing the log file itself?
Is collect bad?

0 Karma

Boopalan
New Member

From the below raw data only json need to be extracted/indexed in the splunk and should be viewed as json structured view while searching this logs on search head

<BOR>
ExSrc:Schwab.Client.Fx^
URL:null^
LogMsg:{"actor":{"Cust":null,"Acct":null,"Rep":null,"System":null},"header":{"AppId":null,"RecId":"null","Ver":"","StartTS":"null"},"source":{"Ip":"*","MacAddress":null,"SRCOS":"null","SRCRuntime":null,"SRCAppName":null,"SRCAppVersion":null,"SRCReqId":"null","CorrelationId":"null","SourceId":null,"Uri":"null"}}^
ExType:Common.Exceptions.ServiceCommunicationException^
<EOR>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...