Splunk: How to Output Nested json as One Field

Knowledge Bits

November 25, 2024

1 min read

Splunk: How to Output Nested json as One Field

Adam Swan
Adam Swan Threat Hunting Engineering Lead linkedin icon Follow

Add to my AI research

ChatGPT icon Perplexity icon ClaudeAI icon Gemini icon

Subscribe to Weekly Digest

Exclusive to SOC Prime users

Newsletter Icon

Often, especially when providing context to analysts who are responsible for triaging alerts, it is useful to provide all of the context that a cloud provider nests in a big json blob as just a single field. You can use the splunk operation “spath” to accomplish this goal.

Note: if you have trouble manipulating the spath’d field, you may have success renaming it. For instance before eval statements.

index=azure AND "signinlogs" 
| spath properties.authenticationDetails{} 
| table properties.authenticationDetails{}
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
Join for Free Book a Meeting

More Knowledge Bits Articles

Search and Replace Text in SPL Fields with rex 1 min read Knowledge Bits Search and Replace Text in SPL Fields with rex by John Stevens rare Сommand in Splunk 1 min read Knowledge Bits rare Сommand in Splunk by Justin Erb coalesce Function in Splunk 1 min read Knowledge Bits coalesce Function in Splunk by Justin Erb