Splunk 查询以从 JSON 单元格获取字段

Question

The splunk query outputs a table where one of the column has these kind of json the part of the query that gives this output is details.ANALYSIS

{"stepSuccess":false,"SR":false,"propertyMap":{"Url":"https://example.com","ErrCode":"401","transactionId":"7caf34342524-3d232133da","status":"API failing with error code 401"}}

I want to edit my splunk query so that instead of this json, I get only Url in this same column.

Here is my splunk query I was using

|dbxquery connection="AT" query="select service.req_id, service.out,details.ANALYSIS from servicerequest service,SERVICEREQUEST_D details where service.out like 'XYZ is%'  and service.row_created > sysdate-1 and service.SERVICEREQUEST_ID = details.SERVICEREQUEST_ID and  details.ANALYSIS_CLASS_NAME = 'GetProduction' " shortnames=0 maxrows=100000001

I tried using details.ANALYSIS.propertyMap.Url but it throws error.

Answer 1

You can probably use spath to extract the fields from details.ANALYSIS

Try the following to extract all fields

| spath field="details.ANALYSIS"

Or this just for the url field you are after

| spath field="details.ANALYSIS" path="propertyMap.Url"