<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to zip multiple cardinalities of nested json arrays? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-zip-multiple-cardinalities-of-nested-json-arrays/m-p/466157#M80319</link>
    <description>&lt;P&gt;We are trying to zip and expand several levels of nested json data. Here is an example of our json data. Below is an example of the desired output.&lt;/P&gt;
&lt;PRE&gt;&lt;CODE&gt;   {
     "level0": {
         "globalname": "TOP_A",
         "globalver": "1",
         "level1": { 
           "level2": [ 
               {
                "lvl2name": "LVL2A", 
                "warnings": { 
                    "totalcount": "26",
                    "rulebreakdown": [
                    { 
                      "rulecount": "2",
                      "rulename": "ruleA"
                    },
                    { 
                     "rulecount": "24",
                     "rulename": "ruleB"
                    }
                 ]
               }
              },

              {
                "lvl2name": "LVL2B", 
                "warnings": { 
                    "totalcount": 81,
                    "rulebreakdown": [
                    { 
                      "rulecount": "11",
                      "rulename": "ruleG"
                    },
                    { 
                     "rulecount": "67",
                     "rulename": "ruleR"
                    },
                    { 
                     "rulecount": "3",
                     "rulename": "ruleZ"
                    }
                 ]
               }
              }
           ]
          }
        }
    }

    {
      "level0": {
          "globalname": "TOP_D",
          "globalver": "1.5",
          "level1": { 
            "level2": [ 
                {
                 "lvl2name": "LVL6A", 
                 "warnings": { 
                     "totalcount": "2",
                     "rulebreakdown": [
                     { 
                       "rulecount": "2",
                       "rulename": "ruleAB"
                     }
                  ]
                }
               }

               {
                 "lvl2name": "LVL6D", 
                 "warnings": { 
                     "totalcount": "23",
                     "rulebreakdown": [
                     { 
                       "rulecount": "5",
                       "rulename": "ruleGG"
                     }
                     { 
                      "rulecount": "14",
                      "rulename": "ruleRG"
                    }
                    { 
                     "rulecount": "4",
                     "rulename": "ruleGZ"
                   }
                  ]
                }
               }
            ]
           }
         }
     }
&lt;/CODE&gt;&lt;/PRE&gt;
&lt;P&gt;This would be the desired output of these two events:&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/8996iD3F375969CDFE14C/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Sun, 07 Jun 2020 01:12:46 GMT</pubDate>
    <dc:creator>cblanton</dc:creator>
    <dc:date>2020-06-07T01:12:46Z</dc:date>
    <item>
      <title>How to zip multiple cardinalities of nested json arrays?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-zip-multiple-cardinalities-of-nested-json-arrays/m-p/466157#M80319</link>
      <description>&lt;P&gt;We are trying to zip and expand several levels of nested json data. Here is an example of our json data. Below is an example of the desired output.&lt;/P&gt;
&lt;PRE&gt;&lt;CODE&gt;   {
     "level0": {
         "globalname": "TOP_A",
         "globalver": "1",
         "level1": { 
           "level2": [ 
               {
                "lvl2name": "LVL2A", 
                "warnings": { 
                    "totalcount": "26",
                    "rulebreakdown": [
                    { 
                      "rulecount": "2",
                      "rulename": "ruleA"
                    },
                    { 
                     "rulecount": "24",
                     "rulename": "ruleB"
                    }
                 ]
               }
              },

              {
                "lvl2name": "LVL2B", 
                "warnings": { 
                    "totalcount": 81,
                    "rulebreakdown": [
                    { 
                      "rulecount": "11",
                      "rulename": "ruleG"
                    },
                    { 
                     "rulecount": "67",
                     "rulename": "ruleR"
                    },
                    { 
                     "rulecount": "3",
                     "rulename": "ruleZ"
                    }
                 ]
               }
              }
           ]
          }
        }
    }

    {
      "level0": {
          "globalname": "TOP_D",
          "globalver": "1.5",
          "level1": { 
            "level2": [ 
                {
                 "lvl2name": "LVL6A", 
                 "warnings": { 
                     "totalcount": "2",
                     "rulebreakdown": [
                     { 
                       "rulecount": "2",
                       "rulename": "ruleAB"
                     }
                  ]
                }
               }

               {
                 "lvl2name": "LVL6D", 
                 "warnings": { 
                     "totalcount": "23",
                     "rulebreakdown": [
                     { 
                       "rulecount": "5",
                       "rulename": "ruleGG"
                     }
                     { 
                      "rulecount": "14",
                      "rulename": "ruleRG"
                    }
                    { 
                     "rulecount": "4",
                     "rulename": "ruleGZ"
                   }
                  ]
                }
               }
            ]
           }
         }
     }
&lt;/CODE&gt;&lt;/PRE&gt;
&lt;P&gt;This would be the desired output of these two events:&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/8996iD3F375969CDFE14C/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Sun, 07 Jun 2020 01:12:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-zip-multiple-cardinalities-of-nested-json-arrays/m-p/466157#M80319</guid>
      <dc:creator>cblanton</dc:creator>
      <dc:date>2020-06-07T01:12:46Z</dc:date>
    </item>
    <item>
      <title>Re: How to zip multiple cardinalities of nested json arrays?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-zip-multiple-cardinalities-of-nested-json-arrays/m-p/466158#M80320</link>
      <description>&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval _raw="[{\"level0\":{\"globalname\":\"TOP_A\",\"globalver\":\"1\",\"level1\":{\"level2\":[{\"lvl2name\":\"LVL2A\",\"warnings\":{\"totalcount\":\"26\",\"rulebreakdown\":[{\"rulecount\":\"2\",\"rulename\":\"ruleA\"},{\"rulecount\":\"24\",\"rulename\":\"ruleB\"}]}},{\"lvl2name\":\"LVL2B\",\"warnings\":{\"totalcount\":81,\"rulebreakdown\":[{\"rulecount\":\"11\",\"rulename\":\"ruleG\"},{\"rulecount\":\"67\",\"rulename\":\"ruleR\"},{\"rulecount\":\"3\",\"rulename\":\"ruleZ\"}]}}]}}},{\"level0\":{\"globalname\":\"TOP_D\",\"globalver\":\"1.5\",\"level1\":{\"level2\":[{\"lvl2name\":\"LVL6A\",\"warnings\":{\"totalcount\":\"2\",\"rulebreakdown\":[{\"rulecount\":\"2\",\"rulename\":\"ruleAB\"}]}},{\"lvl2name\":\"LVL6D\",\"warnings\":{\"totalcount\":\"23\",\"rulebreakdown\":[{\"rulecount\":\"5\",\"rulename\":\"ruleGG\"},{\"rulecount\":\"14\",\"rulename\":\"ruleRG\"},{\"rulecount\":\"4\",\"rulename\":\"ruleGZ\"}]}}]}}}]"
| spath {} output=root
| stats count by root
| spath input=root level0.level1.level2{} output=level2
| stats values(root) as root by level2
| spath input=level2 warnings.rulebreakdown{} output=rulebreakdown
| mvexpand rulebreakdown
| spath input=level2 warnings.totalcount output=totalcount
| spath input=rulebreakdown
| spath input=root level0 output=level0
| spath input=level0
| fields - level* root rulebreakdown
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;That's a lot of work.&lt;/P&gt;</description>
      <pubDate>Thu, 28 May 2020 10:50:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-zip-multiple-cardinalities-of-nested-json-arrays/m-p/466158#M80320</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-05-28T10:50:41Z</dc:date>
    </item>
  </channel>
</rss>

