topic Parse JSON only at 1st level in Splunk Enterprise

Parse JSON only at 1st level

nagar57 — Fri, 11 Sep 2020 09:17:50 GMT

I want my nested JSON to be parsed only at 1st level instead of parsing all the nested parts. I have below JSON:

{ "Name":Naman, "Age":25, "Address": { "H.No":"23", "Street_no":2, "Area":"Model Town" }, "Country":"IND" }

I want output like below:

Name | Age | Address | Country Naman 25 "H.No":"23", IND "Street_no":2, "Area":"Model Town"

I don't want to handle Address field separately as these are dynamic fields that are coming in from source.

Re: Parse JSON only at 1st level

thambisetty — Fri, 11 Sep 2020 09:39:03 GMT

share _raw json otherwise regex may break.

Re: Parse JSON only at 1st level

nagar57 — Fri, 11 Sep 2020 10:35:25 GMT

I can't paste the raw JSON as it contains company data. I hope you get the idea what I am trying to achieve. JSON is dynamic and I just want to parse at 1st level. All the nested fields should come as it is without getting parsed.