Getting Data In

How can i split a json array in mutiple events?

Outek
New Member

Hello

Im trying to split a json Array into multiple Events in the props.conf
Whats the best way to do this?

Here is the json example:

{
"Applications": [
{
"outputname": "Adobe Flash Player",
"version": "19.0.0.185",
},
{
"outputname": "Adobe Reader",
"version": "1.2.3"
},
{
"outputname": "Attachmate Reflection X",
"version": "14.1.1217",
}
],
"TIMESTAMP": "2016-03-07 09:03:43"
}

What should the props.conf look like to split such a file?
thank you for your suggestions.

Tags (3)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

There is no props.conf that will split that correctly into other JSON objects. You will need to pre-process with a script or modular input to achieve that.

However, there is a search hack you can do to make reports on the data.

<your_search> | rename Applications{}.* as * | eval z = mvzip(outputname, version) | mvexpand z | eval z = split(z, ",") | eval outputname=mvindex(z,0), version = mvindex(z,1) | stats count by outputname, version

This will allow you to make reports based on the current JSON event.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

There is no props.conf that will split that correctly into other JSON objects. You will need to pre-process with a script or modular input to achieve that.

However, there is a search hack you can do to make reports on the data.

<your_search> | rename Applications{}.* as * | eval z = mvzip(outputname, version) | mvexpand z | eval z = split(z, ",") | eval outputname=mvindex(z,0), version = mvindex(z,1) | stats count by outputname, version

This will allow you to make reports based on the current JSON event.

Outek
New Member

I know the way with mvzip/mvexpand, but i thought that there is an easier way. We did some tests with SEDCMD in the props.conf, but im not really satisfied with the results

What do you mean with "pre-process with a script or modular input to achieve that" ?
Should i rewrite the script which is writing the json file to only log each arrayline as single Event?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Yes, If you have a script writing out that JSON object, put each item in it's own line. You can put them all in the same file, but Splunk will read them in as individual events.

{ "TIMESTAMP":"2016-03-07 09:03:43", "outputname": "Attachmate Reflection X", "version": "14.1.1217" }
{ "TIMESTAMP":"2016-03-07 09:03:43", "outputname": "Adobe Reader", "version": "1.2.3" }
0 Karma

Outek
New Member

I like this approach, i'll give it a try.. Thanks 🙂

0 Karma

somesoni2
Revered Legend

Do you see any issues with ingesting this json array (which also has non-array element (timestamp)) as full event in Splunk? Splunk will convert this json array values to multivalued field and you should be able to report on them easily.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...