LoginSignup
1

More than 1 year has passed since last update.

Splunk 新しいEval(JSON関連)

Last updated at Posted at 2020-12-17

Splunk DocsのEval Functionsをみていると、見慣れないものを見つけたので紹介します。:sweat:言い方

JSON Functions

https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/JSONFunctions
JSONがspath以外でいろいろと扱えるようになっている。

json_set

json_set_sample.spl
index=_internal | head 1 | fields _raw
| eval _raw="{\"event_type\":\"Threat_Event\",\"ipv4\":\"127.0.0.1\",\"hostname\":\"pc_name.local\",\"occured\":\"01-Dec-2017 22:24:34\",\"severity\":\"Warning\",\"threat_type\":\"potentially unsafe application\"}"
| eval _raw=json_set(_raw,"ipv4","192.168.0.1")

{ [-]
event_type: Threat_Event
hostname: pc_name.local
ipv4: 192.168.0.1
occured: 01-Dec-2017 22:24:34
severity: Warning
threat_type: potentially unsafe application
}
と最初のipv4: 127.0.0.1ipv4: 192.168.0.1に変更している。

json_extract

json_extract_sample.spl
index=_internal | head 1 | fields _raw
| eval _raw="{\"cities\":[{\"name\":\"London\",\"Bridges\":[{\"name\":\"Tower Bridge\",\"length\":801},{\"name\":\"Millennium Bridge\",\"length\":1066}]},{\"name\":\"Venice\",\"Bridges\":[{\"name\":\"Rialto Bridge\",\"length\":157},{\"name\":\"Bridge of Sighs\",\"length\":36},{\"name\":\"Ponte della Paglia\"}]},{\"name\":\"San Francisco\",\"Bridges\":[{\"name\":\"Golden Gate Bridge\",\"length\":8981},{\"name\":\"Bay Bridge\",\"length\":23556}]}]}"
| eval "San_Francisco1"=json_extract(_raw,"cities{2}")
| eval "San_Francisco2"=spath(_raw,"cities{2}")

spathと同じ感じで使える。

json_array

json_array_sample.spl
| makeresults
| eval ponies = json_array("buttercup", "fluttershy", "rarity")
| eval 

アレイはこれで。

json_object

json_object_sample.spl
index=_internal | head 1 | fields _raw
| eval _raw = json_object("ponies" ,json_array("buttercup", "fluttershy", "rarity"))

{ [-] ponies: [ [-] buttercup fluttershy rarity ] }

あとはlookupがあるけど、うまくいかない・・・:cry:

まとめ

makeresultsと同様にJSONもこれでいろいろと作れるようになりました。

リリースノートに載っていなかったので見逃していました。:sweat:

Happy Splunking!

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
What you can do with signing up
1