topic Re: How to parse json array and rename the values? in Getting Data In

How to parse json array and rename the values?

mkamal18 — Tue, 29 Sep 2020 16:52:58 GMT

Hello,

I would like to parse the array called values that contains 45 and 0
I want to rename them then 45 as name and 0 as value

{ [-]
dsnames: [ [+]
]

dstypes: [ [+]
]

host: test

interval: 60
plugin: snmp

plugin_instance:

time: 1510070934.341
type: ps_count

type_instance: fval3-cp-23800-1_vs30

values: [ [-]
45
0

]
}

Can you help me please?

Thank you in advance

Re: How to parse json array and rename the values?

kamlesh_vaghela — Thu, 23 Nov 2017 16:23:23 GMT

Hi @mkamal18,

Use values{} to access values field.

Please check my sample search.

| makeresults 
| eval _raw="{\"values\": [\"45\",\"0\"] }" 
| spath  
| rename values{} as values

Happy Splunking

Re: How to parse json array and rename the values?

niketn — Thu, 23 Nov 2017 16:27:48 GMT

@mkamal18, please try the following run anywhere search. Since you are not worried about dsnames and dstypes JSON nodes, I have taken them out while creating test data as per sample provided. This implies actual JSON field name for values, on using spath command will change from the one used in this example.

|  makeresults
|  eval _raw="{
    \"host\": \"test\", 
    \"interval\": 60 ,
    \"plugin\": \"snmp\", 
    \"plugin_instance\": {
        \"time\": \"1510070934.341\", 
        \"type\": \"ps_count\", 
        \"type_instance\": \"fval3-cp-23800-1_vs30\", 
        \"values\": [45,0]}}"
|  spath
|  rename "plugin_instance.values{}" AS "values"
|  eval name=mvindex(values,0)
|  eval value=mvindex(values,1)

You can pipe spath command to your raw data to get JSON fields extracted. You will notice the *values{} field will be multi-valued array. You would need to rename according to its name to simplified name such as values. Finally use the mvindex() evaluation function to pull values at 0 and 1 index.

<YourBaseSearch>
| spath
|  rename "plugin_instance.values{}" AS "values"
|  eval name=mvindex(values,0)
|  eval value=mvindex(values,1)

PS: Please change the rename command as per actual original field name for *values{}

Re: How to parse json array and rename the values?

mkamal18 — Thu, 23 Nov 2017 16:34:10 GMT

Perfect it works, Thanks man!! 🙂

Re: How to parse json array and rename the values?

niketn — Fri, 24 Nov 2017 04:03:44 GMT

Anytime! Do think of us in case you need further help with your Splunk queries 🙂