如何从 splunk 中的转义 JSON（嵌套）中提取字段？
我正在寻求从 JSON 中提取“allowedSourceAddressPrefix”字段/值的帮助。该字段是嵌套 JSON 内的转义 JSON 字符串。以下是 JSON 树
- properties (extracted by splunk)
- /subscription/..../.../ (dynamic field)
- ports (escaped json)
- allowedSourceAddressPrefix (nested json)
allowedSourceAddressPrefix 采用单个 ip 地址（或）多个 ip 地址（或）* 的值。
我尝试了各种雷克斯模式，但未能提取所需的字段，感谢任何帮助。 的 JSON
properties: {
"User": "[email protected]",
"/subscriptions/3483b2ca-02cf-4ff6-92af-99326c8fac7f/resourceGroups/apple-dev/providers/Microsoft.Compute/virtualMachines/gjappledev": "{\"id\":\"/subscriptions/3483b2ca-02cf-4ff6-92af-99326c8fac7f/resourceGroups/apple-dev/providers/Microsoft.Compute/virtualMachines/gjappledev\",\"ports\":[{\"number\":3389,\"allowedSourceAddressPrefix\":\"*\",\"endTimeUtc\":\"2022-03-21T1:50:39.1599446Z\"}]}",
"Justification": null
}
以下是具有必填字段TIA
I'm looking for help in extracting "allowedSourceAddressPrefix" field/value from a JSON. This field is an escaped JSON string inside a nested JSON. Following is the JSON tree
- properties (extracted by splunk)
- /subscription/..../.../ (dynamic field)
- ports (escaped json)
- allowedSourceAddressPrefix (nested json)
The allowedSourceAddressPrefix takes values of single ipaddress (or) multiple ip addresses (or) *.
I have tried various rex patterns but failed in extracting the required field, Any help is appreciated. Following is the JSON that has the required field
properties: {
"User": "[email protected]",
"/subscriptions/3483b2ca-02cf-4ff6-92af-99326c8fac7f/resourceGroups/apple-dev/providers/Microsoft.Compute/virtualMachines/gjappledev": "{\"id\":\"/subscriptions/3483b2ca-02cf-4ff6-92af-99326c8fac7f/resourceGroups/apple-dev/providers/Microsoft.Compute/virtualMachines/gjappledev\",\"ports\":[{\"number\":3389,\"allowedSourceAddressPrefix\":\"*\",\"endTimeUtc\":\"2022-03-21T1:50:39.1599446Z\"}]}",
"Justification": null
}
TIA
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
了解您尝试过的一些正则表达式会有所帮助，因此我们不再重复它们。
您是否尝试过使用
spath命令来解析 JSON？也许这个
rex命令会有所帮助It would help to know some of the regular expressions you've tried so we don't repeat them.
Have you tried the
spathcommand to parse the JSON?Perhaps this
rexcommand will help