Splunk Search

Failed to parse a JSON string

erwanlebaron
Engager

Hi

 

I get data from an CSV file and one of the filed imported is a JSON string called "Tags" which looks like that

Tags = {"tag1": "toto" "tag2": "tata" "tag4": "titi"}  --> exemple for a line
Tags = {"tag3": "toto" "tag4": "tata"}  --> exemple for another line

 

The delimitation between key and value is <colon>+<space>
The delimitation between two key+value is <space>

 

I tried 

 

 

| spath input=Tags

 

 

but when I do

 

 

| table tag1, tag2, tag3, tag4

 

 

I get value only for tag1.

 

I tried to find a way to solve it by looking other topics but I do not succed.

I understood that my string is not correctly formatted like a "real" Json but I don't fin the command to convert my initialy field "Tags" into a correct Json format to apply the "spath" command

 

Is there anybody has an idea to do it

 

Thanks in adance

Labels (1)
Tags (3)
0 Karma

erwanlebaron
Engager

It works by doing that before the spath command

 

| eval Tags_json=replace(Tags,": ",":")
| eval Tags_json=replace(Tags_json,"\" \"","\",\"")

 

But it doesn't look very elegant...

 

There is a better solution ?

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...