topic Re: extract first value from json subarray in Getting Data In

extract first value from json subarray

kannu — Wed, 30 Sep 2020 05:01:02 GMT

Hello Guys ,

I have one json event in which there is subarray so i want to create one field which will have first index value of array for example

{
"data":
{"task":"pullFrom",
"from_repo":"https://abc.mxz.com:8089",
"to_repo":"https://abc.mxzz.com:8089",
"to_repo_change_count":20008,
"asset_uri":["kannu","search","ui-prefs","search"]
}
}

in above event i wnat to create the field which will have value only "kannu" from subarray "asset_uri" .

I tried doing data.asset_uri[0] as a normal json parsing but splunk is giving error while doing like this

Thanks in advance

Re: extract first value from json subarray

vnravikumar — Wed, 15 Apr 2020 08:43:12 GMT

Check this

| makeresults 
| eval temp="{
\"data\":
{\"task\":\"pullFrom\",
\"from_repo\":\"https://abc.mxz.com:8089\",
\"to_repo\":\"https://abc.mxzz.com:8089\",
\"to_repo_change_count\":20008,
\"asset_uri\":[\"kannu\",\"search\",\"ui-prefs\",\"search\"]
}
}" 
| spath input=temp path=data.asset_uri{} output=asset_uri 
| eval asset_uri=mvindex(asset_uri,0)

Re: extract first value from json subarray

javiergn — Wed, 15 Apr 2020 08:55:06 GMT

Hi @kannu,

Assuming your JSON is extracted correctly you could just do the following:

 | eval first_value = mvindex('data.asset_uri{}', 0)

Regards,
J

Re: extract first value from json subarray

to4kawa — Wed, 15 Apr 2020 09:33:03 GMT

...
| rex "(?ms)asset_uri\":\[\"(?<asset_uri>[^\"]+)"

Re: extract first value from json subarray

kannu — Wed, 15 Apr 2020 09:34:12 GMT

This one is simple , i tried using the same but dont know why it doesnt work for me may be single quote i forget to add .

but thanks for helping me in resolving the issue

Re: extract first value from json subarray

kannu — Wed, 15 Apr 2020 09:34:34 GMT

Thank you ravikumar