CODEWITHSUNDEEP
splunksplunk-querysplunk-dashboard
zen29d
zen29d

Reputation: 59

How to extract the data present in {} in Splunk Search

If the data present in json format {[]} get extracted, however when data present in {} as shown below doesn't behave same. How fields and values can be extracted from data in {}

_raw data:

{"AlertEntityId": "[email protected]", "AlertId": "21-3-1-2-4--12", "AlertType": "System", "Comments": "New alert", "CreationTime": "2022-06-08T16:52:51", "Data": "{\"etype\":\"User\",\"eid\":\"[email protected]\",\"op\":\"UserSubmission\",\"tdc\":\"1\",\"suid\":\"[email protected]\",\"ut\":\"Regular\",\"ssic\":\"0\",\"tsd\":\"Jeff Nichols <[email protected]>\",\"sip\":\"1.2.3.4\",\"srt\":\"1\",\"trc\":\"[email protected]\",\"ms\":\"Grok - AI/ML summary, case study, datasheet\",\"lon\":\"UserSubmission\"}"}

When I perform query "| table Data", I get the below result, But how to get values of "eid", "tsd".

{"etype":"User","eid":"[email protected]","op":"UserSubmission","tdc":"1","suid":"[email protected]","ut":"Regular","ssic":"0","tsd":"Jeff Nichols <[email protected]>","sip":"1.2.3.4","srt":"1","trc":"[email protected]","ms":"Grok - AI/ML summary, case study, datasheet","lon":"UserSubmission"}

Upvotes: 2

Views: 454

Answers (1)

Daniel Price
Daniel Price

Reputation: 483

| spath

by default this will parse the _raw field if the data is in the field "Data"

| spath input=Data

After which eid and tsd will be in fields of the same name.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

Upvotes: 3

Related Questions