https://community.splunk.com/t5/Getting-Data-In/Split-JSON-object-attributes-out-as-key-value/m-p/65649#M13185 <P>How's this look?</P> <P><CODE>sourcetype=your_json | head 1 <BR /> | spath output=gbp path=rates{}.GBP <BR /> | spath output=zar path=rates{}.ZAR<BR /> | table gbp, zar</CODE></P> Wed, 23 Oct 2013 22:47:48 GMT fervin 2013-10-23T22:47:48Z https://community.splunk.com/t5/Getting-Data-In/Split-JSON-object-attributes-out-as-key-value/m-p/65648#M13184 <P>I have a JSON object of currency conversion rates as the event, which looks like</P> <PRE><CODE>{ "base": "USD", "rates": { "GBP": 1.6, "ZAR": 10.2 } } </CODE></PRE> <P>I want to pull the rates out as a table to look like</P> <PRE><CODE>Currency Rate ======== ==== GBP 1.6 ZAR 10.2 </CODE></PRE> <P>I can't figure out how to pull out the attribute as a column</P> Tue, 17 Sep 2013 17:01:08 GMT https://community.splunk.com/t5/Getting-Data-In/Split-JSON-object-attributes-out-as-key-value/m-p/65648#M13184 johnoxley_liqui 2013-09-17T17:01:08Z https://community.splunk.com/t5/Getting-Data-In/Split-JSON-object-attributes-out-as-key-value/m-p/65649#M13185 <P>How's this look?</P> <P><CODE>sourcetype=your_json | head 1 <BR /> | spath output=gbp path=rates{}.GBP <BR /> | spath output=zar path=rates{}.ZAR<BR /> | table gbp, zar</CODE></P> Wed, 23 Oct 2013 22:47:48 GMT https://community.splunk.com/t5/Getting-Data-In/Split-JSON-object-attributes-out-as-key-value/m-p/65649#M13185 fervin 2013-10-23T22:47:48Z