<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How can I format the JSON file? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-format-the-JSON-file/m-p/488460#M83582</link>
    <description>&lt;P&gt;Hi all,&lt;/P&gt;

&lt;P&gt;I have loaded a JSON file from API interface. I have this JSON structure:&lt;/P&gt;

&lt;P&gt;{&lt;BR /&gt;
   "productName": "ORACLE RDBMS",&lt;BR /&gt;
   "supplier": {&lt;BR /&gt;
      "supplierName": "ORACLE"&lt;BR /&gt;
   },&lt;BR /&gt;
   "components": [&lt;BR /&gt;
      {&lt;BR /&gt;
         "componentName": "ORACLE CLIENT",&lt;BR /&gt;
         "versions": [&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "12.1.0.1",&lt;BR /&gt;
               "gaDate": "2013-07-01",&lt;BR /&gt;
               "eosDate": "2015-07-22",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 0,&lt;BR /&gt;
                  "predicition6M": 0,&lt;BR /&gt;
                  "predicition12M": 0&lt;BR /&gt;
               }&lt;BR /&gt;
            },&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "12.1.0.2",&lt;BR /&gt;
               "gaDate": "2014-07-01",&lt;BR /&gt;
               "eosDate": "2021-07-01",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 4,&lt;BR /&gt;
                  "predicition6M": 3&lt;BR /&gt;
                  "predicition12M": 3&lt;BR /&gt;
               }&lt;BR /&gt;
            },&lt;BR /&gt;
          ]&lt;BR /&gt;&lt;BR /&gt;
      {&lt;BR /&gt;
         "componentName": "ORACLE DATABASE",&lt;BR /&gt;
         "versions": [&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "8.1",&lt;BR /&gt;
               "gaDate": "2000-09-01",&lt;BR /&gt;
               "eosDate": "2005-01-01",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 2,&lt;BR /&gt;
                  "predicition6M": 1,&lt;BR /&gt;
                  "predicition12M": 0&lt;BR /&gt;
                  }&lt;BR /&gt;
            },&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "9.2",&lt;BR /&gt;
               "gaDate": "2002-07-01",&lt;BR /&gt;
               "eosDate": "2007-08-01",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 2,&lt;BR /&gt;
                  "predicition6M": 2,&lt;BR /&gt;
                  "predicition12M": 1,&lt;BR /&gt;
               }&lt;BR /&gt;
            },&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "10.1",&lt;BR /&gt;
               "gaDate": "2004-01-01",&lt;BR /&gt;
               "eosDate": "2009-01-01",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 4,&lt;BR /&gt;
                  "predicition6M": 4,&lt;BR /&gt;
                  "predicition12M": 3&lt;BR /&gt;
               }&lt;BR /&gt;
            },&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;     ]
  }
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;]&lt;BR /&gt;
}&lt;/P&gt;

&lt;P&gt;and I need to create this table:&lt;/P&gt;

&lt;P&gt;ProductName ComponentName   Version eosDate current predicition6M   predicition12M&lt;BR /&gt;
ORACLE RDBMS    ORACLE CLIENT   12.1.0.1    22/07/2015  0   0   0&lt;BR /&gt;
ORACLE RDBMS    ORACLE CLIENT   12.1.0.2    01/07/2021  4   3   3&lt;BR /&gt;
ORACLE RDBMS    ORACLE DATABASE 8.1 01/01/2005  2   1   0&lt;BR /&gt;
ORACLE RDBMS    ORACLE DATABASE 9.2 01/08/2007  2   2   1&lt;BR /&gt;
ORACLE RDBMS    ORACLE DATABASE 10.1    01/01/2009  4   4   3&lt;/P&gt;

&lt;P&gt;How can I do?&lt;BR /&gt;
Tks&lt;BR /&gt;
Gianluca&lt;/P&gt;</description>
    <pubDate>Fri, 20 Sep 2019 16:05:36 GMT</pubDate>
    <dc:creator>gdermiliis</dc:creator>
    <dc:date>2019-09-20T16:05:36Z</dc:date>
    <item>
      <title>How can I format the JSON file?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-format-the-JSON-file/m-p/488460#M83582</link>
      <description>&lt;P&gt;Hi all,&lt;/P&gt;

&lt;P&gt;I have loaded a JSON file from API interface. I have this JSON structure:&lt;/P&gt;

&lt;P&gt;{&lt;BR /&gt;
   "productName": "ORACLE RDBMS",&lt;BR /&gt;
   "supplier": {&lt;BR /&gt;
      "supplierName": "ORACLE"&lt;BR /&gt;
   },&lt;BR /&gt;
   "components": [&lt;BR /&gt;
      {&lt;BR /&gt;
         "componentName": "ORACLE CLIENT",&lt;BR /&gt;
         "versions": [&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "12.1.0.1",&lt;BR /&gt;
               "gaDate": "2013-07-01",&lt;BR /&gt;
               "eosDate": "2015-07-22",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 0,&lt;BR /&gt;
                  "predicition6M": 0,&lt;BR /&gt;
                  "predicition12M": 0&lt;BR /&gt;
               }&lt;BR /&gt;
            },&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "12.1.0.2",&lt;BR /&gt;
               "gaDate": "2014-07-01",&lt;BR /&gt;
               "eosDate": "2021-07-01",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 4,&lt;BR /&gt;
                  "predicition6M": 3&lt;BR /&gt;
                  "predicition12M": 3&lt;BR /&gt;
               }&lt;BR /&gt;
            },&lt;BR /&gt;
          ]&lt;BR /&gt;&lt;BR /&gt;
      {&lt;BR /&gt;
         "componentName": "ORACLE DATABASE",&lt;BR /&gt;
         "versions": [&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "8.1",&lt;BR /&gt;
               "gaDate": "2000-09-01",&lt;BR /&gt;
               "eosDate": "2005-01-01",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 2,&lt;BR /&gt;
                  "predicition6M": 1,&lt;BR /&gt;
                  "predicition12M": 0&lt;BR /&gt;
                  }&lt;BR /&gt;
            },&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "9.2",&lt;BR /&gt;
               "gaDate": "2002-07-01",&lt;BR /&gt;
               "eosDate": "2007-08-01",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 2,&lt;BR /&gt;
                  "predicition6M": 2,&lt;BR /&gt;
                  "predicition12M": 1,&lt;BR /&gt;
               }&lt;BR /&gt;
            },&lt;BR /&gt;
            {&lt;BR /&gt;
               "version": "10.1",&lt;BR /&gt;
               "gaDate": "2004-01-01",&lt;BR /&gt;
               "eosDate": "2009-01-01",&lt;BR /&gt;
               "versionScore": {&lt;BR /&gt;
                  "current": 4,&lt;BR /&gt;
                  "predicition6M": 4,&lt;BR /&gt;
                  "predicition12M": 3&lt;BR /&gt;
               }&lt;BR /&gt;
            },&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;     ]
  }
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;]&lt;BR /&gt;
}&lt;/P&gt;

&lt;P&gt;and I need to create this table:&lt;/P&gt;

&lt;P&gt;ProductName ComponentName   Version eosDate current predicition6M   predicition12M&lt;BR /&gt;
ORACLE RDBMS    ORACLE CLIENT   12.1.0.1    22/07/2015  0   0   0&lt;BR /&gt;
ORACLE RDBMS    ORACLE CLIENT   12.1.0.2    01/07/2021  4   3   3&lt;BR /&gt;
ORACLE RDBMS    ORACLE DATABASE 8.1 01/01/2005  2   1   0&lt;BR /&gt;
ORACLE RDBMS    ORACLE DATABASE 9.2 01/08/2007  2   2   1&lt;BR /&gt;
ORACLE RDBMS    ORACLE DATABASE 10.1    01/01/2009  4   4   3&lt;/P&gt;

&lt;P&gt;How can I do?&lt;BR /&gt;
Tks&lt;BR /&gt;
Gianluca&lt;/P&gt;</description>
      <pubDate>Fri, 20 Sep 2019 16:05:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-format-the-JSON-file/m-p/488460#M83582</guid>
      <dc:creator>gdermiliis</dc:creator>
      <dc:date>2019-09-20T16:05:36Z</dc:date>
    </item>
    <item>
      <title>Re: How can I format the JSON file?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-format-the-JSON-file/m-p/488461#M83583</link>
      <description>&lt;P&gt;What have you tried so far?  What results did you get?&lt;/P&gt;</description>
      <pubDate>Fri, 20 Sep 2019 16:38:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-format-the-JSON-file/m-p/488461#M83583</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2019-09-20T16:38:47Z</dc:date>
    </item>
    <item>
      <title>Re: How can I format the JSON file?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-can-I-format-the-JSON-file/m-p/488462#M83584</link>
      <description>&lt;P&gt;I have tried with these search commands:&lt;/P&gt;

&lt;P&gt;index="test" source="test.json" productName="ORACLE RDBMS" | rename components.versions.version AS VERSION, components.versions.versionScore.obsolescenceDate AS OBSDATE, components.componentName AS COMP_NAME, productName AS PROD_NAME | spath| eval a=mvzip(COMP_NAME,VERSION,OBSDATE)&lt;BR /&gt;
| mvexpand a | eval a = split(a,",") | eval COMP_NAME=mvindex(a,0) | eval VERSION=mvindex(a,1) | eval OBSDATE=mvindex(a,2) |table product, Name,COMP_NAME,VERSION,OBSDATE&lt;/P&gt;

&lt;P&gt;the result is:&lt;/P&gt;

&lt;P&gt;product Name    COMP_NAME   VERSION OBSDATE&lt;BR /&gt;
18/09/2019 15:40            ORACLE CLIENT   12.1.0.1&lt;BR /&gt;
18/09/2019 15:40            ORACLE DATABASE 12.1.0.2&lt;BR /&gt;
18/09/2019 15:40            DATAGUARD   12.2.1.2&lt;/P&gt;</description>
      <pubDate>Wed, 30 Sep 2020 02:19:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-can-I-format-the-JSON-file/m-p/488462#M83584</guid>
      <dc:creator>gdermiliis</dc:creator>
      <dc:date>2020-09-30T02:19:32Z</dc:date>
    </item>
  </channel>
</rss>

