将嵌套 Json 解析为包含字符串的 splunk 查询

Question

我有一个 macAddress 的多个结果，其中包含设备详细信息。

这是示例数据

    "data": {
        "a1:b2:c3:d4:11:22": {
            "deviceIcons": {
                "type": "Phone",
                "icons": {
                    "3x": null,
                    "2x": "image.png"
                }
            },
            "advancedDeviceId": {
                "agentId": 113,
                "partnerAgentId": "131",
                "dhcpHostname": "Galaxy-J7",
                "mac": "a1:b2:c3:d4:11:22",
                "lastSeen": 12,
                "model": "Android Phoe",
                "id": 1
            }
        },
        "a0:b2:c3:d4:11:22": {
            "deviceIcons": {
                "type": "Phone",
                "icons": {
                    "3x": null,
                    "2x": "image.png"
                }
            },
            "advancedDeviceId": {
                "agentId": 113,
                "partnerAgentId": "131",
                "dhcpHostname": "Galaxy",
                "mac": "a0:b2:c3:d4:11:22",
                "lastSeen": 12,
                "model": "Android Phoe",
                "id": 1
            }
        }
    }
}

如何在 splunk 中查询上述所有类型的示例结果以获取表格格式的 advanceDeviceId.model 和 advanceDeviceId.id？

Answer 1

我认为这将满足您的需求

| spath
| untable _time column value
| rex field=column "data.(?<address>[^.]+)\.advancedDeviceId\.(?<item>[^.]+)"
| table _time address item value
| eval {item}=value
| stats list(model) as model
        list(id) as id
        list(dhcpHostname) as dhcpHostname
        list(mac) as mac
        by address

这是一个“随处运行”示例，其中有两个事件，每个事件都有两个地址：

| makeresults
| eval _raw="{\"data\":{\"a1:b2:c3:d4:11:21\":{\"deviceIcons\":{\"type\":\"Phone\",\"icons\":{\"3x\":null,\"2x\":\"image.png\"}},\"advancedDeviceId\":{\"agentId\":113,\"partnerAgentId\":\"131\",\"dhcpHostname\":\"Galaxy-J7\",\"mac\":\"a1:b2:c3:d4:11:21\",\"lastSeen\":12,\"model\":\"Android Phoe\",\"id\":1}},\"a0:b2:c3:d4:11:22\":{\"deviceIcons\":{\"type\":\"Phone\",\"icons\":{\"3x\":null,\"2x\":\"image.png\"}},\"advancedDeviceId\":{\"agentId\":113,\"partnerAgentId\":\"131\",\"dhcpHostname\":\"iPhone 6\",\"mac\":\"a0:b2:c3:d4:11:22\",\"lastSeen\":12,\"model\":\"Apple Phoe\",\"id\":2}}}}"
| append [
    | makeresults
    | eval _raw="{\"data\":{\"b1:b2:c3:d4:11:23\":{\"deviceIcons\":{\"type\":\"Phone\",\"icons\":{\"3x\":null,\"2x\":\"image.png\"}},\"advancedDeviceId\":{\"agentId\":113,\"partnerAgentId\":\"131\",\"dhcpHostname\":\"Nokia\",\"mac\":\"b1:b2:c3:d4:11:23\",\"lastSeen\":12,\"model\":\"Symbian Phoe\",\"id\":3}},\"b0:b2:c3:d4:11:24\":{\"deviceIcons\":{\"type\":\"Phone\",\"icons\":{\"3x\":null,\"2x\":\"image.png\"}},\"advancedDeviceId\":{\"agentId\":113,\"partnerAgentId\":\"131\",\"dhcpHostname\":\"Windows\",\"mac\":\"b0:b2:c3:d4:11:24\",\"lastSeen\":12,\"model\":\"Windows Phoe\",\"id\":4}}}}"
]
| spath
| untable _time column value
| rex field=column "data.(?<address>[^.]+)\.advancedDeviceId\.(?<item>[^.]+)"
| table _time address item value
| eval {item}=value
| stats list(model) as model
        list(id) as id
        list(dhcpHostname) as dhcpHostname
        list(mac) as mac
        by address