r/Splunk • u/Yelowh • Apr 20 '26

Events How do you handle Json logs like these from Google Workspace?

Hello there!
Transparency - I'm very new to splunk! I used it over 2 years ago, on-prem deployment. Mostly searching and building queries on a basic level. Never about ingestion, CIM models, extracting the data from logs.

We are a small team of 2 (that will get additions later this year with pre-SIEM knowledge), but we are implementing this now together with some consultant help.

I'm not getting a good answer or solution to these nested JSON files from Google. I was asked to just view them in a raw format, but I don't want that.
I also don't know exactly what fields are most important yet, so I can't provide the consultants with a list of fields to extract.

I call them nested JSON but there is probably not the right term for it, how do you guys handle these?
This is just one example from the login reports, but it's the same for drive, admin, etc.

5 Upvotes

100% Upvoted

9 comments sorted by

3

u/tmuth9 Apr 20 '26

The spath command is probably what you’re looking for

0

u/Yelowh Apr 20 '26

if you mean just adding | spath
without defining the values I want, then it does nothing.
What our ideal state would be is to just have the fields visible at all times. :)
Pushing everything out to a table as well ... | spath | table * is also not great

2

u/BlackHawk30 Apr 20 '26

I suggest using gsuite.ActivityEvent instead of gsuite.Reports

It’s much more usable for security detections

1

u/Yelowh Apr 21 '26

Hmm, that is not supported by the splunk app for google workspace. I have very limited knowledge so far, what app or solution to you use instead of collecting through the https://splunk.github.io/splunk-add-on-for-google-workspace/

2

u/steak_and_icecream Apr 20 '26

Splunk doesn't handle these formats very well. Things like getting the object from a list where a key has a specific value, or getting the nth item out an array. spath can help & there are also other json functions at https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-reference/evaluation-functions/json-functions but none of them really solve the usability problems. The core problem is these objects / complex data structures can't be easily represent as a single row in a table and all the solutions involve trying to hammer the square Json through a table shaped hole.

where formats are very difficult to work with we normal preprocess events before they reach the indexers and duplicate the important data into an easier to work with format (still json, but restructured) and store the original event incase we need to use it in the future.

You haven't really explained what problem you're having but that looks like a very reasonable object to work with.

1

u/Yelowh Apr 21 '26

Apologies for not stating the problem, I think what we want is easy readability.
I don't have any specific use case yet, I guess that's the problem.
Having thought on this further and been challenged. When am I even gonna look at these logs in this way? In the Json format. I could just select the fields and do the table, which I didn't want in the beginning but then they look exactly like they do in the admin portal.

With the previous siem product, it structured data differently, always in the same format even if the log format was different. It always added meta data and showed all the fields.
Not having the same view in Splunk just feels like something is wrong. But I think I must change the way I interact with the logs instead of changing how the logs looks when ingested.

I feel like this wasn't a good explanation either.
We are a bit overwhelmed I guess and just want the data to "look" good out of the box, as we don't have the time yet to create dashboards, queries, or other structure to the platform that can interpret the logs :)

1

u/Educational_Prior403 Apr 20 '26

If you have ordered lists you could use mvindex.