CODEWITHSUNDEEP
splunksplunk-query
Piotr Gorak
Piotr Gorak

Reputation: 97

Extract a field from nested json in a splunk query

This is the data I have:

{ "a":"1",
  "b":2,
  "c": { "x":"3", "y":"4",}
}

let's suppose I have tons of events in that format. What I want to do is to write a query that will only extract "x"s from all events. I don't want anything else to be returned, just the "x"s.

I've tried multiple examples and I went through pages of documentation and yet I still did not succeed with this, there must be something I'm missing. Please advise.

Upvotes: 0

Views: 2564

Answers (2)

RichG
RichG

Reputation: 9926

This query works for me. Note the missing comma after the "y" value. Splunk will produce unexpected results if the JSON is not valid.

| makeresults
| eval _raw="{ \"a\":\"1\",
  \"b\":2,
  \"c\": { \"x\":\"3\", \"y\":\"4\"}
}"
| spath output=foo path=c.x
| table foo

Upvotes: 0

RichG
RichG

Reputation: 9926

It would help to know what you've tried so far and how those attempts failed to meet expectations.

Have you tried the rex command?

| rex max_match=0 "\\\"x\\\":\\\"(?<x>[^\\\"]+)"

The forest of backslashes is needed to escape the embedded quotation marks through multiple parsers.

Upvotes: 0

Related Questions