topic Re: How to extract the nested array coordinates from JSON? in Getting Data In

How to extract the nested array coordinates from JSON?

weiquanswq — Thu, 06 Oct 2016 10:18:57 GMT

Hi !!
I am new to Splunk and trying to extract the array coordinates from Json.

{"type":"Feature","geometry":{"type":"MultiPoint","coordinates":[[103.62107,1.27478],[103.622,1.29625],  ……., [103.6224,1.28207]]}}

Is anyone able to help me out here?

Thanks

Re: How to extract the nested array coordinates from JSON?

sshelly_splunk — Tue, 11 Oct 2016 17:04:39 GMT

Try this in your props.conf:
under the sourcetype or monitor stanza:

Example:

[myjson_sourcetype]
EXTRACT-coordinates = `\[\[(?P<coord_1>\S+)],\[(?P<coord_2>\S+)\].+\[(?P<coord_3>\S+)\]\]`

The above will create the 3 fields (coord_1, 2 and 3. Assuming the data comes in like that, you should be good to go. If not, please post more of the data, so we can all take a look.

Re: How to extract the nested array coordinates from JSON?

weiquanswq — Wed, 12 Oct 2016 09:01:22 GMT

I able to achieve the results I want using spath and extract according to the index.

My code is as follows:
... | spath path=features{}.geometry.coordinates{}{0} output=a | spath path=features{}.geometry.coordinates{}{1} output=b | table a b | eval x=mvzip(a,b)| mvexpand x

Hope this will be useful. 🙂