Getting Data In

Data search in JSON format

arttifex
New Member

Good day. I did not find the answer to my question, so I made a new topic. My device sends data from IDS in JSON format. I get this data in Splunk. The data is presented below in the screenshot. I try to search on various data, but it doesn’t work. I see that the search is successful, but I don’t see the fields I need. In the "questions and answers" section, I found a recommendation to change the value of the "KV_MODE" field, but this did not help. Please tell me what I'm doing wrong. What I need to pay attention to.

The data has the following structure:

Apr 22 18:09:26 172.20.8.2 Apr 22 18:09:54 vpnfw dmutmd[1505]:
{

"source": "IDS",

"message":
{
"alert":
{
"action":"allowed",
"category":"A Network Trojan was detected",
"gid":1,
"metadata":
{

"affected_product":["Windows_XP_Vista_7_8_10_Server_32_64_Bit"],
"attack_target":["Client_Endpoint"],
"created_at":["2015_03_13"],
"deployment":["Perimeter"],
"former_category":["ADWARE_PUP"],
"group_tss":["2"],
"malware_family":["Loadmoney"],
"performance_impact":["Low"],
"priority":["1"],
"signature_severity":["Minor"],
"tag":["Loadmoney"],
"updated_at":["2019_10_07"]
},
"rev":8,
"severity":1,
"signature":"ET MALWARE Loadmoney User Agent",
"signature_id":2024249
},
"app_proto":"http",
"dest_ip":"5.9.80.173",
"dest_port":80,
"event_type":"alert"
}
}

I'm doing a search with the following query: "IDS | spath path=message.alert.category" and get a result.

alt text
alt text

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

The long term solution is to fix your ingestion and props so that JSONs are automatically extracted. In the meantime, you can use this code sample for finding your immediate solutions. A full run-anywhere example is after the break.

| rename COMMENT as "the below reformats that data so you can look at it."
| rex "^[\s\S]*?(?<myJSON>{[\s\S]*})"
| spath input=myJSON

Here's the full run-anywhere sample for anyone who wants to play with it.

|makeresults 
| rename COMMENT as "The above creates one dummy record, and the below inputs your sample data"
| eval _raw  = "Apr 22 18:09:26 172.20.8.2 Apr 22 18:09:54 vpnfw dmutmd[1505]:
{
\"source\": \"IDS\",
\"message\":
{
\"alert\":
{
\"action\":\"allowed\",
\"category\":\"A Network Trojan was detected\",
\"gid\":1,
\"metadata\":
{
\"affected_product\":[\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],
\"attack_target\":[\"Client_Endpoint\"],
\"created_at\":[\"2015_03_13\"],
\"deployment\":[\"Perimeter\"],
\"former_category\":[\"ADWARE_PUP\"],
\"group_tss\":[\"2\"],
\"malware_family\":[\"Loadmoney\"],
\"performance_impact\":[\"Low\"],
\"priority\":[\"1\"],
\"signature_severity\":[\"Minor\"],
\"tag\":[\"Loadmoney\"],
\"updated_at\":[\"2019_10_07\"]
},
\"rev\":8,
\"severity\":1,
\"signature\":\"ET MALWARE Loadmoney User Agent\",
\"signature_id\":2024249
},
\"app_proto\":\"http\",
\"dest_ip\":\"5.9.80.173\",
\"dest_port\":80,
\"event_type\":\"alert\"
}
}"
| rename COMMENT as "The above just inputs your sample data"

| rename COMMENT as "the below reformats that data so you can look at it."
| rex "^[\s\S]*?(?<myJSON>{[\s\S]*})"
| spath input=myJSON
0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...