Passing the message field in JSON to Splunk

kpimentel

I'm having trouble getting the JSON under the "message" field recognized in splunk. Is there something simple I'm missing on the Cribl side of things to break this json out of message, or only keep the JSON in the message as the event?

Jon Rust

is _raw shown as `a` or `{}`?

kpimentel

α

Jon Rust

Try this: Parser function -> source _raw -> destination _raw -> JSON -> extract

Jon Rust

now _raw should be `{}` if yes, is message also `{}`, or still `a`?

kpimentel

_raw is now `{}` message is still `a`

Jon Rust

add another parser -> source _raw.message -> destination _raw,message -> JSON -> extract

Jon Rust

my bet is that the message field was escaped (double escaped?) JSON

Jon Rust

with the 2nd parser, is it showing as `{}`?

kpimentel

yes it is

Jon Rust

noice

Jon Rust

should be good to send to splunk now

Jon Rust

(to be safe, i'd probably add a final function, Serialize, to turn _raw (all of it) back into a string):

Jon Rust

this time though, it will only be 1 level of stringification, so splunk will handle it

kpimentel

it took a minute but looks great in Splunk now

kpimentel

Thanks for the help!