Why spath is not working when there is text before and after json data.

[jw44250]

index=index1 sourcetype=test1 |spath output=myfield path=Student{}.SubjectDetails{}.type |table myfield, Class

{
"Class": "11",
"date": "05/16/2016",
"Student": [
{
"RollNo": "1234",
"SubjectDetails": [
{
"type": "Mandatory",
"startTime": "05/16/2016 21:30",
"endTime": "05/16/2016 22:00",
"name": "English"
},
{
"type": "Optional",
"startTime": "05/16/2016 20:00",
"endTime": "05/16/2016 21:30",
"name": "Math"
}
]
}
]
}

the above splunk query can work if the result is only contains JSON but it will not work when before and after there text with before and after JSON Data.

got data from external x machine.
{
"Class": "11",
"date": "05/16/2016",
"Student": [
{
"RollNo": "1234",
"SubjectDetails": [
{
"type": "Mandatory",
"startTime": "05/16/2016 21:30",
"endTime": "05/16/2016 22:00",
"name": "English"
},
{
"type": "Optional",
"startTime": "05/16/2016 20:00",
"endTime": "05/16/2016 21:30",
"name": "Math"
}
]
}
]
}
got data from external x machine.

[niketn]

@jw44250, use replace() eval function with regular expression to remove got data from external x machine. from _raw data. You should also think about dropping the data with regular expression REGEX using props.conf and transforms.conf before indexing: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad.

|  makeresults
|  eval _raw="got data from external x machine.
{
\"Class\": \"11\",
\"date\": \"05/16/2016\",
\"Student\": [
{
\"RollNo\": \"1234\",
\"SubjectDetails\": [
{
\"type\": \"Mandatory\",
\"startTime\": \"05/16/2016 21:30\",
\"endTime\": \"05/16/2016 22:00\",
\"name\": \"English\"
},
{
\"type\": \"Optional\",
\"startTime\": \"05/16/2016 20:00\",
\"endTime\": \"05/16/2016 21:30\",
\"name\": \"Math\"
}
]
}
]
}
got data from external x machine."
| eval _raw=replace(_raw,"got data from external \w+ machine\.", "")
| spath

[jw44250]

replace wont work as the text keeps changes ...the text lenght can be very as well.

[niketn]

@jw44250 , as mentioned above replace() uses regular expression. If you would notice based on your sample data I have added \w+ for Machine name with word characters. You can change regular expression based on Regular Expression pattern of data before and after JSON.

If you are not able to figure out the regular expression yourself, you will have to provide some sample events of data before and after JSON. (Start and End of JSON can also be used for Regular Expression match).