topic Re: How to parse array to get only required attribute? in Getting Data In

How to parse array to get only required attribute?

Techie — Thu, 02 Feb 2023 00:24:48 GMT

Hello,

I have an array of timeline event.

Timeline: [ [-]
       { [-]
         deltaToStart: 788
         startTime: 2023-02-01T21:56:11Z
         type: service1
       }
       { [-]
         deltaToStart: 653
         startTime: 2023-02-01T21:56:11.135Z
         type: service2
       }
     ]

I would like to table deltaToStart value only of type service1.

Thanks.

Re: How to parse array to get only required attribute?

ITWhisperer — Thu, 02 Feb 2023 08:17:46 GMT

Try something like this

| spath Timeline{} output=Timeline | mvexpand Timeline | spath input=Timeline | where type="service1" | table deltaToStart

Re: How to parse array to get only required attribute?

Techie — Fri, 03 Feb 2023 21:23:47 GMT

@ITWhisperer , thanks for responding. Can you also help me to calculate sum of both durations and table all 3 fields (message.duration, deltaToStart, total_time)

total_time = message.duration + deltaToStart (of type service1)

message: { [-]
duration: 182
Timeline: [ [-]
{ [-]
deltaToStart: 788
startTime: 2023-02-01T21:56:11Z
type: service1
}
{ [-]
deltaToStart: 653
startTime: 2023-02-01T21:56:11.135Z
type: service2
}
]
}

Re: How to parse array to get only required attribute?

ITWhisperer — Sat, 04 Feb 2023 06:18:30 GMT

What have you tried so far?