使用spath进行json解析

时间:2019-07-12 18:22:51

标签: regex splunk splunk-calculation splunk-formula

我有一个json日志,如下所示

{
action: Get, 
applicationName: abc,
controller: Main, 
ip: 123.123.123.123, 
logLevel: INFO, 
loggerType: abcdef, 
machineName: windows, 
message: {"Value":{"Data":{"Items":[{"FieldType":"abc","Value":""},{"FieldType":"abcd","Value":""},{"FieldType":"123","Value":""}],"EncryptedDocKey":"123456","Domain":"Order","Partner":"India","Carrier":"Idea"},"RequestTrackerId":"7894561230","Message":"OK"},"Formatters":[],"ContentTypes":[],"DeclaredType":null,"StatusCode":null} 
principalId: 22222222-2222-2222-2222-222222222222 
requestMethod: POST 
requestUrl: https://abc123.com/api/v1/get 
responseData: {"Value":{"Data":{"Items":[{"FieldType":"abc","Value":""},{"FieldType":"123","Value":""},{"FieldType":"xyz","Value":""}],"EncryptedDocKey":"123456789","Domain":"Order","Partner":"india","Carrier":"idea"},"RequestTrackerId":"7894561230","Message":"OK"},"Formatters":[],"ContentTypes":[],"DeclaredType":null,"StatusCode":null} 
time: 2019-07-10 18:35:23.3893, 
traceId: 12345678963525, 
userName: abc/12345 
}

所有字段均已正确索引。我正在寻找提取message元素中的json数据。我想使用spath将FieldType,EncryptedDocKey,Domain,Partner,Carrier,RequestTrackerId提取到其自己的字段中。

也欢迎任何其他替代选项。感谢您的帮助。

尝试过正则表达式,但不起作用

0 个答案:

没有答案