topic Re: How to display JSON map as a single multi-value field instead of multiple auto-discovered fields? in Getting Data In

How to display JSON map as a single multi-value field instead of multiple auto-discovered fields?

sbarinov — Wed, 20 Jun 2018 12:04:19 GMT

Hello,

I have an input module that injects data as _json source type.
In each event I have a field named "parameters" that contains a map (key-value entries) like this:

"parameters": {
   "parameter-a": "1",
   "parameter-b": "2",
   ...
}

I don't know the map keys, they may correlate between events but are not consistent.
Splunk automatically extracts them as "parameters.parameter-a" and "parameters.parameter-b" fields and this is not what I want.
It would rather have a multi-value field named "parameters" with each line containing both key and value like:

parameter-a=1
parameter-b=2

When I use:

| spath output=parameters path=parameters

I get a field that contains a raw JSON value of the "parameters" field (with brackets, quotes and commas).
When I use:

| spath output=parameters path=parameters{}

I get empty field values.
Is there a way to do what I want?

Thank you.

Re: How to display JSON map as a single multi-value field instead of multiple auto-discovered fields?

poete — Thu, 21 Jun 2018 12:44:14 GMT

Hello @sbarinov,

please try this:

| makeresults 
| eval js="{\"parameters\": {\"parameter-a\": \"1\",\"parameter-b\": \"2\"}}"
| spath input=js path=parameters output=someOtherField
| spath input=someOtherField
| foreach parameter* [eval parameters=mvappend(parameters, '<<FIELD>>')]

Re: How to display JSON map as a single multi-value field instead of multiple auto-discovered fields?

sbarinov — Fri, 22 Jun 2018 07:44:14 GMT

Thank you.

Re: How to display JSON map as a single multi-value field instead of multiple auto-discovered fields?

poete — Wed, 25 Sep 2019 05:09:51 GMT

Welcome ! Any time.

Re: How to display JSON map as a single multi-value field instead of multiple auto-discovered fields?

esalesap — Wed, 07 Oct 2020 15:16:32 GMT

How would you write the foreach statement if the parameters didn't share a name prefix like this: ?

| eval js="{\"parameters\": {\"wookie\": \"1\",\"jabba\": \"2\"}}"