Thanks For Downloading!Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows: Windows: Decompress the downloaded file using a tool like 7-Zip and place the resulting folder into Unix/Linux: Decompress the downloaded file using a tool like DescriptionProvides commands for extracting fields from json structures. jsonutils provides a pair of commands for extracting fields from json data in _raw. jsonkv is smaller and faster, will use less memory and may work on incomplete or invalid json. jsonkvrecursive will parse the json and create a field for every value, including arrays, but will only work on valid json. jsonkvjsonkv uses regular expressions to pull field values from a given json. Examples:Given this json:
jsonkv jsonkvrecursivejsonkvrecursive recursively builds fields from the field name hierarchy. Examples:Given this json:
produces: glossary_title="example glossary" glossary_GlossDiv_title="S" glossary_GlossDiv_GlossList_GlossEntry_ID="SGML" glossary_GlossDiv_GlossList_GlossEntry_SortAs="SGML" glossary_GlossDiv_GlossList_GlossEntry_GlossTerm="Standard Generalized Markup Language" glossary_GlossDiv_GlossList_GlossEntry_Acronym="SGML" glossary_GlossDiv_GlossList_GlossEntry_Abbrev="ISO 8879:1986" glossary_GlossDiv_GlossList_GlossEntry_GlossDef_para="A meta-markup language, used to create markup languages such as DocBook." glossary_GlossDiv_GlossList_GlossEntry_GlossDef_GlossSeeAlso=["GML","XML"] glossary_GlossDiv_GlossList_GlossEntry_GlossSee="markup" Versions and Release Notes
Version 1.0 (current version - updated Dec 30, 2010)
|
