topic Re: Array extraction with optional elements in Getting Data In

Array extraction with optional elements

psable — Sun, 03 Jul 2016 13:14:57 GMT

{
"Version" : 2
Diagnostic: [
{ Name: "Brian", School :"KVG" },
{ Name: "Steve", School :"MKG" },
{ Name: "Gerry" },
{LastName: "Todd", School :"HVD" }
]

How can I get these fields extracted so that it looks like this:

Name Last Name School

Brian - KVG
Steve - MKG
Gerry - -
- Obama HVD

Thanks !

Re: Array extraction with optional elements

javiergn — Mon, 04 Jul 2016 07:22:40 GMT

| stats count | fields - count
| eval _raw = " {
    \"Version\" : 2
    Diagnostic: [
        { Name: \"Brian\", School :\"KVG\" },
        { Name: \"Steve\", School :\"MKG\" },
        { Name: \"Gerry\" },
        { LastName: \"Todd\", School :\"HVD\" }
    ]
}
"
| rex field=_raw max_match=0 "(?mi)\{\s*(?<keyvalue>.+)\s*\}\,?\n"
| mvexpand keyvalue
| streamstats count as N
| eval keyvalue = split(keyvalue, ",")
| mvexpand keyvalue
| rex field=keyvalue max_match=0 "(?msi)(?<key>\w+)[\s:\"]+(?<value>[^\"]+)"
| eval {key} = value
| fields - keyvalue, key, value
| stats first(*) as * by N, _raw
| fillnull value="-"
| table Name, LastName, School

Output:

Re: Array extraction with optional elements

psable — Tue, 05 Jul 2016 17:56:49 GMT

Thank you !