JSON is a fantastic logging format and Splunk has built in support for it. However, when dealing with JSON logs, there’s a certain field structure that can be a little tricky to manage: The issue here is that Splunk will extract these fields as name=foo and value=bar by default. I’ve tried a couple [...]

The post SPL Tricks: Dealing with Nested Name-Value Pairs in JSON appeared first on Hurricane Labs.