<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to build JSON object with python script? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-build-JSON-object-with-python-script/m-p/161255#M32681</link>
    <description>&lt;P&gt;I am making a custom module and cannot, for the life of me, figure out how the python script is working.  I am using the Example 6 script as a guide and my main trouble is with this piece:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;dataset = getattr(job, entity_name)[offset: offset+count]
        outputJSON = {}
        for i, result in enumerate(dataset):
            tdict = {}
            tdict[str(result.get('processor', None))] = str(result.get('value', None))
            name = str(result.get('name', None))
            if name not in outputJSON:
                outputJSON[name] = dict()
            outputJSON[name].update(tdict)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I can see what it is doing, but my results are much different than a simple table.  I need a way of pulling out the first value in a table cell, then the second, etc.  This script outputs a JSON array of &lt;BR /&gt;
&lt;CODE&gt;{name:foo, {processor1 : value}, {processor2:value}, {etc}}&lt;/CODE&gt; .  &lt;/P&gt;

&lt;P&gt;I need a JSON array of something more complex, like:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;{
 "name": "flare",
 "children": [
  {
   "name": "analytics",
   "children": [
    {
     "name": "cluster",
     "children": [
      {"name": "AgglomerativeCluster", "value": 3938},
      {"name": "CommunityStructure", "value": 3812},
      {"name": "HierarchicalCluster", "value": 6714},
      {"name": "MergeEdge", "value": 743}
     ]
    },
    {
     "name": "graph",
     "children": [
      {"name": "BetweennessCentrality", "value": 3534},
      {"name": "LinkDistance", "value": 5731},
      {"name": "MaxFlowMinCut", "value": 7840},
      {"name": "ShortestPaths", "value": 5914},
      {"name": "SpanningTree", "value": 3416}
     ]
    },
    {
     "name": "optimization",
     "children": [
      {"name": "AspectRatioBanker", "value": 7074}
     ]
    }
   ]
  },
  {
   "name": "animate",
   "children": [
    {"name": "Easing", "value": 17010},
    {"name": "FunctionSequence", "value": 5842},
    {
     "name": "interpolate",
     "children": [
      {"name": "ArrayInterpolator", "value": 1983},
      {"name": "ColorInterpolator", "value": 2047},
      {"name": "DateInterpolator", "value": 1375},
      {"name": "Interpolator", "value": 8746},
      {"name": "MatrixInterpolator", "value": 2202},
      {"name": "NumberInterpolator", "value": 1382},
      {"name": "ObjectInterpolator", "value": 1629},
      {"name": "PointInterpolator", "value": 1675},
      {"name": "RectangleInterpolator", "value": 2042}
     ]
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;In other words, I need to build a JSON object that is much more complex than a 1:1 mapping, like in this example.  Does anyone have any ideas on how to complete this?  I still haven't been able to figure out if things like tdict[str(result.get( is just a python thing, or a splunk thing.&lt;/P&gt;</description>
    <pubDate>Tue, 29 Jul 2014 13:25:39 GMT</pubDate>
    <dc:creator>slashnburn</dc:creator>
    <dc:date>2014-07-29T13:25:39Z</dc:date>
    <item>
      <title>How to build JSON object with python script?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-build-JSON-object-with-python-script/m-p/161255#M32681</link>
      <description>&lt;P&gt;I am making a custom module and cannot, for the life of me, figure out how the python script is working.  I am using the Example 6 script as a guide and my main trouble is with this piece:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;dataset = getattr(job, entity_name)[offset: offset+count]
        outputJSON = {}
        for i, result in enumerate(dataset):
            tdict = {}
            tdict[str(result.get('processor', None))] = str(result.get('value', None))
            name = str(result.get('name', None))
            if name not in outputJSON:
                outputJSON[name] = dict()
            outputJSON[name].update(tdict)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I can see what it is doing, but my results are much different than a simple table.  I need a way of pulling out the first value in a table cell, then the second, etc.  This script outputs a JSON array of &lt;BR /&gt;
&lt;CODE&gt;{name:foo, {processor1 : value}, {processor2:value}, {etc}}&lt;/CODE&gt; .  &lt;/P&gt;

&lt;P&gt;I need a JSON array of something more complex, like:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;{
 "name": "flare",
 "children": [
  {
   "name": "analytics",
   "children": [
    {
     "name": "cluster",
     "children": [
      {"name": "AgglomerativeCluster", "value": 3938},
      {"name": "CommunityStructure", "value": 3812},
      {"name": "HierarchicalCluster", "value": 6714},
      {"name": "MergeEdge", "value": 743}
     ]
    },
    {
     "name": "graph",
     "children": [
      {"name": "BetweennessCentrality", "value": 3534},
      {"name": "LinkDistance", "value": 5731},
      {"name": "MaxFlowMinCut", "value": 7840},
      {"name": "ShortestPaths", "value": 5914},
      {"name": "SpanningTree", "value": 3416}
     ]
    },
    {
     "name": "optimization",
     "children": [
      {"name": "AspectRatioBanker", "value": 7074}
     ]
    }
   ]
  },
  {
   "name": "animate",
   "children": [
    {"name": "Easing", "value": 17010},
    {"name": "FunctionSequence", "value": 5842},
    {
     "name": "interpolate",
     "children": [
      {"name": "ArrayInterpolator", "value": 1983},
      {"name": "ColorInterpolator", "value": 2047},
      {"name": "DateInterpolator", "value": 1375},
      {"name": "Interpolator", "value": 8746},
      {"name": "MatrixInterpolator", "value": 2202},
      {"name": "NumberInterpolator", "value": 1382},
      {"name": "ObjectInterpolator", "value": 1629},
      {"name": "PointInterpolator", "value": 1675},
      {"name": "RectangleInterpolator", "value": 2042}
     ]
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;In other words, I need to build a JSON object that is much more complex than a 1:1 mapping, like in this example.  Does anyone have any ideas on how to complete this?  I still haven't been able to figure out if things like tdict[str(result.get( is just a python thing, or a splunk thing.&lt;/P&gt;</description>
      <pubDate>Tue, 29 Jul 2014 13:25:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-build-JSON-object-with-python-script/m-p/161255#M32681</guid>
      <dc:creator>slashnburn</dc:creator>
      <dc:date>2014-07-29T13:25:39Z</dc:date>
    </item>
    <item>
      <title>Re: How to build JSON object with python script?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-build-JSON-object-with-python-script/m-p/161256#M32682</link>
      <description>&lt;P&gt;Not sure if I understood your question corrently, but &lt;EM&gt;(having already made a long reply, getting deleted by "You cannot include external links with this low karma" &amp;lt;insert cursing&amp;gt;, I'll make it short)&lt;/EM&gt;&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;All the function and methods used in your code snippet are from Python's built-in functions and types' methods. None of them are from Splunk's Python SDK.&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;For reference, see:&lt;/P&gt;

&lt;P&gt;https://docs.python.org/2/library/functions.html (&lt;STRONG&gt;getattr()&lt;/STRONG&gt;, &lt;STRONG&gt;enumerate()&lt;/STRONG&gt;, &lt;STRONG&gt;str()&lt;/STRONG&gt;)&lt;/P&gt;

&lt;P&gt;https://docs.python.org/2/library/stdtypes.html#dict.get&lt;/P&gt;

&lt;P&gt;As for how to form a more complex JSON object; you do exactly similar dictionary &amp;amp; list processing. &lt;/P&gt;

&lt;P&gt;JSON.dumps() converts python dictionaries { } to JSON objects, and python lists [ ] to JSON arrays.&lt;/P&gt;

&lt;P&gt;See https://docs.python.org/2/library/json.html#encoders-and-decoders for full details on how default JSON encoder/decoder works.&lt;/P&gt;</description>
      <pubDate>Sun, 10 Aug 2014 16:01:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-build-JSON-object-with-python-script/m-p/161256#M32682</guid>
      <dc:creator>CynthiaMhav</dc:creator>
      <dc:date>2014-08-10T16:01:19Z</dc:date>
    </item>
  </channel>
</rss>

