Extract a field from nested json in a splunk query

Piotr Gorak 0
Viewed 62

This is the data I have:

{ "a":"1",
  "b":2,
  "c": { "x":"3", "y":"4",}
}

let's suppose I have tons of events in that format. What I want to do is to write a query that will only extract "x"s from all events. I don't want anything else to be returned, just the "x"s.

I've tried multiple examples and I went through pages of documentation and yet I still did not succeed with this, there must be something I'm missing. Please advise.

splunk-query splunk
2 Answers

It would help to know what you've tried so far and how those attempts failed to meet expectations.

Have you tried the rex command?

| rex max_match=0 "\\\"x\\\":\\\"(?<x>[^\\\"]+)"

The forest of backslashes is needed to escape the embedded quotation marks through multiple parsers.

RichG0

This query works for me. Note the missing comma after the "y" value. Splunk will produce unexpected results if the JSON is not valid.

| makeresults
| eval _raw="{ \"a\":\"1\",
  \"b\":2,
  \"c\": { \"x\":\"3\", \"y\":\"4\"}
}"
| spath output=foo path=c.x
| table foo
RichG0
Related