topic Re: How do I extract fields from a JSON map while keeping the relationship? in Getting Data In

How do I extract fields from a JSON map while keeping the relationship?

atjohnso — Wed, 10 Oct 2018 00:30:32 GMT

Hi,

My stakeholders would like view events in the following JSON map log format, together in one record parsed out into separate fields:

  "cookie": [{
    "a": 1,
    "b": 1,
    "c": 1
  }, {
    "a": 2,
    "b": 2,
    "c": 2
  }, {
    "a": 3,
    "b": 3,
    "c": 3
  }]
}

Desired report in Splunk :

a | b| c (header)
1 1 1
2 2 2
3 3 3

Is there a way to support this in Splunk?

If there is not an easy way, we can change the log structure. We wish to keep the information in JSON format, however (structuring log as a long string and regexing is not an option).

Thank you.

Re: How do I extract fields from a JSON map while keeping the relationship?

493669 — Wed, 10 Oct 2018 10:27:10 GMT

try below in props.conf to extracts fields from JSON data.-

[<YourSourcetypeName>]
 KV_MODE=JSON

Re: How do I extract fields from a JSON map while keeping the relationship?

kamlesh_vaghela — Wed, 10 Oct 2018 15:36:41 GMT

Can you please try below search?

YOUR_SEARCH
| rename cookie{}.* as * 
| eval temp = mvzip(mvzip(c,b),c) 
| stats count by _time temp 
| eval a=mvindex(split(temp,","),0),b=mvindex(split(temp,","),1),c=mvindex(split(temp,","),2) 
| table a b c

My Sample Search:

| makeresults 
| eval _raw="{ \"cookie\": [{
\"a\": 1,
\"b\": 1,
\"c\": 1
}, {
\"a\": 2,
\"b\": 2,
\"c\": 2
}, {
\"a\": 3,
\"b\": 3,
\"c\": 3
}]
}" 
| kv 
| rename cookie{}.* as * 
| eval temp = mvzip(mvzip(c,b),c) 
| stats count by _time temp 
| eval a=mvindex(split(temp,","),0),b=mvindex(split(temp,","),1),c=mvindex(split(temp,","),2) 
| table a b c

Thanks