is it recommended to do a json extract after the GeoIP function?
Josh Brunvoll
Posts: 3 ✭
Hey Folks, i have a silly Q, I am using GeoIP with maxminddbs and it adds a json array like it should. When it gets into Splunk, the only way to search elements in the array requires an | spath command and cant search like a normal key=value. is it recommended to do a json extract after the GeoIP function? if not, how should I pull those fields?
0
Answers
-
i'd use flatten, and filter out the unwanted entries (other languages etc)
0 -
Ohh Flatten. Didnt even cross my mind on that command. Thanks a bunch!
0 -
Eval to remove junk fields:
0 -
then flatten
0 -
then Rename:
0
