topic Re: Trying to parse my Json into a table in Getting Data In

Trying to parse my Json into a table

dperry — Tue, 29 Sep 2020 12:41:16 GMT

this is the format:

{
"epoch": "1485892851.94944",
"id": "3952418",
"name": "WMI Performance Adapter",
"new_attrs": "{\"DisplayName\":\"WMI Performance Adapter\",\"ServiceName\":\"wmiApSrv\",\"enabled\":\"Manual\",\"state\":\"Running\",\"User\":\"localSystem\"}",
"new_scan_id": "513186",
"node_environment_id": "2",
"node_id": "153",
"node_name": "servername",
"node_primary_node_group_id": "68",
"old_attrs": "{\"DisplayName\":\"WMI Performance Adapter\",\"ServiceName\":\"wmiApSrv\",\"enabled\":\"Manual\",\"state\":\"Stopped\",\"User\":\"localSystem\"}",
"old_scan_id": "513150",
"path": "{services,windows}",
"status": "modified",
"type": "services",
"updated_at": "2017-01-31 20:00:51.949442"
}

trying to use the spath

Re: Trying to parse my Json into a table

rsennett_splunk — Tue, 29 Sep 2020 12:38:36 GMT

I believe this is what you are looking for:
I selected one field from new_attr and old_attr because it is the only one that differs. Otherwise you can't see what's happening.

 index=blah sourcetype=blah 
| spath input=new_attrs 
|rename state AS newState
|spath input=old_attrs
|rename state AS oldState
|table newState oldState

But you would simply rename the ones you wanted. ie rename state as newState, DisplayName AS newDisplay, ServiceName AS Fred

Re: Trying to parse my Json into a table

dperry — Wed, 01 Feb 2017 00:28:07 GMT

Thanks Producer! This is along the lines of what I was visioning.

Re: Trying to parse my Json into a table

rsennett_splunk — Wed, 01 Feb 2017 00:44:03 GMT

woohoo! Excellent. 🙂