topic Re: Splunk to split a multivalue json in Getting Data In

Splunk to split a multivalue json

sssignals — Wed, 30 Sep 2020 01:13:37 GMT

Hi Splunk community

I have been trying for 2 days using spath, mvindex, split on the following json... this is a row in Splunk with 4 event sizes and times. Some event have 1 event size and time. Some have more. I want to access the individual event size and time eg.
| table flowKey eventsize1 eventtime1 eventsize2 eventtime2

Please give me some advice and guidance. Thanks so much.

{"_id":{"$oid":"dfsahu13fd"},"flowKey":"null,null,...", "size_of_events":[1.1121356e+08,1.1121357e+08,1.1121357e+08,1.1121358e+08],"time_of_events":[{"$numberLong":"1548454548"},{"$numberLong":"1548454549"},{"$numberLong":"1548454555"},{"$numberLong":"1548454559"}]...}

Re: Splunk to split a multivalue json

FrankVl — Wed, 03 Jul 2019 09:11:16 GMT

Dealing with a variable number of fields is going to be difficult, I don't know of any proper way to do that.

Is there a large variance in the number of sizes and times that can be in an event? If it is limited to max. 5 or so, you could do something like:

...do rex/spath extractions that result in mulitvalued fields `eventsizes` and `eventtimes`...
| eval eventsize1 = mvindex(eventsizes,0)
| eval eventsize2 = mvindex(eventsizes,1)
| eval eventsize3 = mvindex(eventsizes,2)
| eval eventsize4 = mvindex(eventsizes,3)
| eval eventsize5 = mvindex(eventsizes,4)
| eval eventtime1 = mvindex(eventtimes,0)
| eval eventtime2 = mvindex(eventtimes,1)
| eval eventtime3 = mvindex(eventtimes,2)
| eval eventtime4 = mvindex(eventtimes,3)
| eval eventtime5 = mvindex(eventtimes,4)
| table flowKey eventsize1 eventtime1 eventsize2 eventtime2 eventsize3 eventtime3 eventsize4 eventtime4 eventsize5 eventtime5

But as you can see, that gets very ugly if the range of possible number of 'columns' can be much bigger.

Re: Splunk to split a multivalue json

sssignals — Wed, 03 Jul 2019 09:20:54 GMT

Hi FrankVI

I swore I tried something like your solution but I cannot hack it.
Maybe I am starting to see stars and commas.

Thanks for your speedy help! Really works!