topic Re: I need help from you guru's! Split custom json array. in Getting Data In

I need help from you guru's! Split custom json array.

pir8radio — Thu, 24 Jun 2021 20:15:14 GMT

{ "miners":[ { "address":"7338594461977886954", "addressRS":"S-GJ9C-T2EF-C82A-8EZPD", "pendingBalance":"0 SIGNA", "totalCapacity":80.04373488882364, "totalEffectiveCapacity":64.44006329147014, "commitment":"2467.564 SIGNA", "committedBalance":"159010 SIGNA", "boost":0.4127924541887127, "boostPool":0.6147618784432624, "sharedCapacity":64.44006329147014, "sharePercent":100, "donationPercent":1, "nConf":120, "share":0.4091681714251888, "minimumPayout":"10 SIGNA", "currentRoundBestDeadline":"511", "name":"Pir8Radio", "userAgent":"signum-miner/1.8.0" }, { "address":"632........... REPEATS FOR EACH USER

So my json output looks like the above, but there are anywhere from 1-1000 users.. I'm not quite sure how to break up each user and have each of the stats per user? Any help would be greatly appreciated guys.. thanks!!

Re: I need help from you guru's! Split custom json array.

ITWhisperer — Thu, 24 Jun 2021 20:32:20 GMT

| spath output=miners path=miners{} | mvexpand miners | spath input=miners

Re: I need help from you guru's! Split custom json array.

pir8radio — Thu, 24 Jun 2021 20:42:57 GMT

Using windows... so don't laugh but how do I add this in.. Most of you guys edit configs directly.. get me started and ill make it happen lol. Thank you for the fast response by the way.

Re: I need help from you guru's! Split custom json array.

ITWhisperer — Thu, 24 Jun 2021 20:46:53 GMT

Perhaps you need to be more specific - the solution I gave was for SPL assuming you had already injested the events. Is this not the case?

Re: I need help from you guru's! Split custom json array.

pir8radio — Thu, 24 Jun 2021 21:05:49 GMT

I have an index, and im ingesting json using the REST plugin. so every poll i get a big json chunk with all the users... SPluk can id the different fields but not associate each stat with each user.. so right now my index has big chunks with all users as one entry. I can wipe out the stored data and start over.. that is fine. i just started logging.

If that makes sense. so if thats just a search i'll give it a go

Re: I need help from you guru's! Split custom json array.

pir8radio — Thu, 24 Jun 2021 21:09:32 GMT

here is the actual json request as it gets logged in splunk. https://signapool.notallmine.net/api/getMiners

Re: I need help from you guru's! Split custom json array.

pir8radio — Thu, 24 Jun 2021 22:07:16 GMT

Ok, anyone else? 🙂

Re: I need help from you guru's! Split custom json array.

ITWhisperer — Thu, 24 Jun 2021 22:38:22 GMT

Here is a runanywhere example using the event you posted - what stats do you want from it?

| makeresults | eval _raw="{\"miners\":[{\"address\":\"7338594461977886954\",\"addressRS\":\"S-GJ9C-T2EF-C82A-8EZPD\",\"pendingBalance\":\"0 SIGNA\",\"totalCapacity\":75.31094514725329,\"totalEffectiveCapacity\":56.25448389009368,\"commitment\":\"2826.619 SIGNA\",\"committedBalance\":\"159010 SIGNA\",\"boost\":1.9199166724521135,\"boostPool\":0.7454754057371029,\"sharedCapacity\":53.99130845212486,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":119,\"share\":0.4057046502172909,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"510\",\"name\":\"Pir8Radio\",\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"6329949665716025039\",\"addressRS\":\"S-QFQH-PVVK-HX3S-7Z5QH\",\"pendingBalance\":\"0 SIGNA\",\"totalCapacity\":29.64209609401988,\"totalEffectiveCapacity\":27.174675922368234,\"commitment\":\"4186.25 SIGNA\",\"committedBalance\":\"113760 SIGNA\",\"boost\":1.9820980132905137,\"boostPool\":0.8901186355139484,\"sharedCapacity\":26.081410908997512,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":119,\"share\":0.19598246446260806,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"421\",\"name\":\"🌕🌕🌕SBC🌕🌕🌕\",\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"5812913123670292755\",\"addressRS\":\"S-7YAM-Q2DB-UXXS-7XWC3\",\"pendingBalance\":\"0 SIGNA\",\"totalCapacity\":22.580104076894848,\"totalEffectiveCapacity\":19.782211125928406,\"commitment\":\"4632.849 SIGNA\",\"committedBalance\":\"91648 SIGNA\",\"boost\":1.286007872566661,\"boostPool\":0.9318075735151683,\"sharedCapacity\":18.986352534169132,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":119,\"share\":0.14266836153095883,\"minimumPayout\":\"18 SIGNA\",\"currentRoundBestDeadline\":\"495\",\"name\":\"paulpoco\",\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"17310617114525064813\",\"addressRS\":\"S-2RMF-KMB3-FK8X-HCXG2\",\"pendingBalance\":\"0 SIGNA\",\"totalCapacity\":9.850986684343951,\"totalEffectiveCapacity\":9.641490876245662,\"commitment\":\"5151.382 SIGNA\",\"committedBalance\":\"49667 SIGNA\",\"boost\":1.8643733751940388,\"boostPool\":0.9775330078600667,\"sharedCapacity\":8.510711099569583,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":116,\"share\":0.06395168349759459,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"619\",\"name\":\"WELLDONE_POTATOE\",\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"634311141621026044\",\"addressRS\":\"S-BM9W-MXJQ-Y455-28EMK\",\"pendingBalance\":\"17.298 SIGNA\",\"totalCapacity\":37.04124665731926,\"totalEffectiveCapacity\":19.5338019446403,\"commitment\":\"1253.675 SIGNA\",\"committedBalance\":\"24489.04 SIGNA\",\"boost\":1.2477031162957093,\"boostPool\":0.5164172843603285,\"sharedCapacity\":6.377672865751389,\"sharePercent\":100,\"donationPercent\":0,\"nConf\":119,\"share\":0.04792348274897464,\"minimumPayout\":\"50 SIGNA\",\"currentRoundBestDeadline\":\"480\",\"name\":\"FireLord\",\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"16204010563066647250\",\"addressRS\":\"S-9NQL-S6Q6-8PXW-GP3S3\",\"pendingBalance\":\"0 SIGNA\",\"totalCapacity\":14.845193386287551,\"totalEffectiveCapacity\":5.778028067750265,\"commitment\":\"762.89 SIGNA\",\"committedBalance\":\"4408 SIGNA\",\"boost\":0.6907886673068294,\"boostPool\":0.41265974932843114,\"sharedCapacity\":5.5455720873812115,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":119,\"share\":0.04167086237520553,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"627\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"3336683774319003736\",\"addressRS\":\"S-J44S-8VE3-GXJE-4ALMW\",\"pendingBalance\":\"0 SIGNA\",\"totalCapacity\":4.239844698375725,\"totalEffectiveCapacity\":4.802757049016315,\"commitment\":\"5824.988 SIGNA\",\"committedBalance\":\"27976 SIGNA\",\"boost\":2.4025754704854068,\"boostPool\":1.0333107784075894,\"sharedCapacity\":4.802757049016315,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":120,\"share\":0.036089158135101794,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"558\",\"name\":\"grigori1\",\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"5001136275876726878\",\"addressRS\":\"S-9L4Y-YAGH-A3F7-6UWTC\",\"pendingBalance\":\"8.564 SIGNA\",\"totalCapacity\":16.990399427429523,\"totalEffectiveCapacity\":6.468733086016492,\"commitment\":\"680.195 SIGNA\",\"committedBalance\":\"4400 SIGNA\",\"boost\":0.7859672261188412,\"boostPool\":0.39182514514105526,\"sharedCapacity\":3.706555655210909,\"sharePercent\":80,\"donationPercent\":5,\"nConf\":106,\"share\":0.027852017458359662,\"minimumPayout\":\"25 SIGNA\",\"currentRoundBestDeadline\":\"569\",\"name\":\"Viperlock\",\"userAgent\":\"Foxy-Miner 2.2.0 | Scavenger/1.9.0\"},{\"address\":\"2144851752025549787\",\"addressRS\":\"S-QUYV-BRVP-355K-3D2KV\",\"pendingBalance\":\"3.155 SIGNA\",\"totalCapacity\":0.9149721792007489,\"totalEffectiveCapacity\":2.9212612144674965,\"commitment\":\"47373.374 SIGNA\",\"committedBalance\":\"138390 SIGNA\",\"boost\":4.9465856708602685,\"boostPool\":2.6622262743654592,\"sharedCapacity\":2.9212612144674965,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":120,\"share\":0.02195111200647761,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"666\",\"name\":\"* * * * * GIANT IBIS * * * * *\",\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"10829838926518806423\",\"addressRS\":\"S-MTWR-5ZQX-MKVF-BKULE\",\"pendingBalance\":\"0.092 SIGNA\",\"totalCapacity\":6.429200088487606,\"totalEffectiveCapacity\":0.8036500110609508,\"commitment\":\"2.489 SIGNA\",\"committedBalance\":\"2 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.4247729093488849,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":89,\"share\":0.003191853458450276,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"708\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"12960513174160693352\",\"addressRS\":\"S-WQ5A-43QB-J2ZW-DY9R9\",\"pendingBalance\":\"3.265 SIGNA\",\"totalCapacity\":3.0248080371838486,\"totalEffectiveCapacity\":0.3781010046479811,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.36288961441529366,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":119,\"share\":0.002726846381476241,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"782\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"4797194384010021713\",\"addressRS\":\"S-P4UK-W2NQ-KJV3-6GS67\",\"pendingBalance\":\"0.53 SIGNA\",\"totalCapacity\":4.311981541484528,\"totalEffectiveCapacity\":0.538997692685566,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.31098862193207527,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":94,\"share\":0.0023368489058639298,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"694\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"10864836473989681144\",\"addressRS\":\"S-TMZS-8PRF-WX3M-B9XKF\",\"pendingBalance\":\"4.879 SIGNA\",\"totalCapacity\":2.5689239725633213,\"totalEffectiveCapacity\":0.32122318953838236,\"commitment\":\"93.393 SIGNA\",\"committedBalance\":\"30 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.30830005199632254,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":119,\"share\":0.002316646296283973,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"737\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"9217648703491104145\",\"addressRS\":\"S-UREK-P4FY-69BC-9CXUZ\",\"pendingBalance\":\"0.202 SIGNA\",\"totalCapacity\":1.278215168861012,\"totalEffectiveCapacity\":0.1597768961076265,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.14103783539413114,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":116,\"share\":0.0010597947580158692,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"816\",\"name\":\"HozzeV\",\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"11076040043519891082\",\"addressRS\":\"S-4PNC-RKW2-K62A-BZHFM\",\"pendingBalance\":\"0.153 SIGNA\",\"totalCapacity\":0.9644757590268633,\"totalEffectiveCapacity\":0.12055946987835792,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.11570923906695607,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":119,\"share\":8.694691369481119E-4,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"774\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"3906077914631750304\",\"addressRS\":\"S-ZJP2-7E5B-F9U6-5FBFE\",\"pendingBalance\":\"8.349 SIGNA\",\"totalCapacity\":0.8359864324858371,\"totalEffectiveCapacity\":0.10449830406072964,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.10449830406072964,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":120,\"share\":7.85227272920257E-4,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"782\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"1509210197686251620\",\"addressRS\":\"S-SW56-PQY9-86TJ-3CGWB\",\"pendingBalance\":\"8.547 SIGNA\",\"totalCapacity\":2.1053507351304113,\"totalEffectiveCapacity\":0.5676523546392392,\"commitment\":\"369.945 SIGNA\",\"committedBalance\":\"210 SIGNA\",\"boost\":0.22219037242821305,\"boostPool\":0.2612061010940822,\"sharedCapacity\":0.0720778351736484,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":28,\"share\":5.416114879578125E-4,\"minimumPayout\":\"10 SIGNA\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"13204057683630652547\",\"addressRS\":\"S-6Z65-J7BB-FYHR-DWKHG\",\"pendingBalance\":\"0.304 SIGNA\",\"totalCapacity\":1.339230289408306,\"totalEffectiveCapacity\":0.16740378617603824,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.06272037095332507,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":70,\"share\":4.71297082597672E-4,\"minimumPayout\":\"10 SIGNA\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"9095273544309588611\",\"addressRS\":\"S-BJN5-585T-9AYW-999GW\",\"pendingBalance\":\"0.02 SIGNA\",\"totalCapacity\":0.5603028732991716,\"totalEffectiveCapacity\":0.07003785916239645,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.06036029018063888,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":115,\"share\":4.5356282551412247E-4,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"813\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"11050193483021082142\",\"addressRS\":\"S-XRJY-FNME-M6X3-BEKQL\",\"pendingBalance\":\"0.069 SIGNA\",\"totalCapacity\":0.4257465325188933,\"totalEffectiveCapacity\":0.05321831656486166,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.05107728924453362,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":119,\"share\":3.838079565227756E-4,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"849\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"4369731203934338717\",\"addressRS\":\"S-6HNX-E599-SNLV-595BT\",\"pendingBalance\":\"0.008 SIGNA\",\"totalCapacity\":0.31639017261108104,\"totalEffectiveCapacity\":0.03954877157638513,\"commitment\":\"809.128 SIGNA\",\"committedBalance\":\"32 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.03954877157638513,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":120,\"share\":2.9717969426779837E-4,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"816\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"3477857487842173733\",\"addressRS\":\"S-9ST7-YPR6-7TSR-5NYJ2\",\"pendingBalance\":\"0.065 SIGNA\",\"totalCapacity\":0.3068310538870128,\"totalEffectiveCapacity\":0.0383538817358766,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.0383538817358766,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":120,\"share\":2.88200983088358E-4,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"785\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"1537199703052625350\",\"addressRS\":\"S-MBG8-ZK6N-TZ6C-3UBPC\",\"pendingBalance\":\"0.035 SIGNA\",\"totalCapacity\":0.2888982673695822,\"totalEffectiveCapacity\":0.03611228342119777,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.03611228342119777,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":120,\"share\":2.71357033825842E-4,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"847\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"9668348497838843138\",\"addressRS\":\"S-VBA4-RHB7-ST9M-AZ8DE\",\"pendingBalance\":\"0.015 SIGNA\",\"totalCapacity\":0.1528103147612833,\"totalEffectiveCapacity\":0.01910128934516041,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.01729456232432842,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":117,\"share\":1.29955812511461E-4,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"747\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"10024450332997509033\",\"addressRS\":\"S-TRXB-GX9F-CNQX-A2J9Q\",\"pendingBalance\":\"0.004 SIGNA\",\"totalCapacity\":0.05120049575043778,\"totalEffectiveCapacity\":0.0064000619688047225,\"commitment\":\"2.297 SIGNA\",\"committedBalance\":\"0.015 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.005955925376942687,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":118,\"share\":4.475436308263284E-5,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"940\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"9150359739525198539\",\"addressRS\":\"S-YWQD-QHAQ-WX57-9V6ZX\",\"pendingBalance\":\"0 SIGNA\",\"totalCapacity\":0.27688141870394095,\"totalEffectiveCapacity\":0.03461017733799262,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":0.004914502050555262,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":31,\"share\":3.69288389663802E-5,\"minimumPayout\":\"10 SIGNA\",\"currentRoundBestDeadline\":\"727\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"},{\"address\":\"18405447763800643374\",\"addressRS\":\"S-JPTG-98CP-NLST-HBCVY\",\"pendingBalance\":\"0 SIGNA\",\"totalCapacity\":0.017799375255017083,\"totalEffectiveCapacity\":0.0022249219068771354,\"commitment\":\"0 SIGNA\",\"committedBalance\":\"0 SIGNA\",\"boost\":0.125,\"boostPool\":0.125,\"sharedCapacity\":1.1515163221441187E-4,\"sharePercent\":100,\"donationPercent\":1,\"nConf\":12,\"share\":8.652791348986004E-7,\"minimumPayout\":\"10 SIGNA\",\"name\":null,\"userAgent\":\"signum-miner/1.8.0\"}],\"explorer\":\"https://explorer.burstcoin.network/?action=account&account=\",\"poolCapacity\":236.6708208799129}" | spath output=miners path=miners{} | mvexpand miners | fields - _* | spath input=miners

Re: I need help from you guru's! Split custom json array.

pir8radio — Thu, 24 Jun 2021 23:35:21 GMT

So each user has stats, in the original post that shows just my user "pir8radio" (shown below) I need to be able to create dashboards off of the user stats. Below the address and addressRS represent one user.. Everything else is his data. So my user S-GJ9C-T2EF-C82A-8EZPD is also know as 7338594461977886954 or by name: Pir8Radio, has a pending balance of 0 Signa, a total capacity of 80.xxxxx etc etc.. This data is grabbed by splunk every 2 mins. I need to chart based on this data. filtered however i filter it on the dashboard. normal splunk usage.. my issue is that there are multiple users data polled every 2 mins in one json response.. so i need to tie all of the info below as one record, then the next user as another record, then i can break out the fileds per record.

{ "address":"7338594461977886954", "addressRS":"S-GJ9C-T2EF-C82A-8EZPD", "pendingBalance":"0 SIGNA", "totalCapacity":80.04373488882364, "totalEffectiveCapacity":64.44006329147014, "commitment":"2467.564 SIGNA", "committedBalance":"159010 SIGNA", "boost":0.4127924541887127, "boostPool":0.6147618784432624, "sharedCapacity":64.44006329147014, "sharePercent":100, "donationPercent":1, "nConf":120, "share":0.4091681714251888, "minimumPayout":"10 SIGNA", "currentRoundBestDeadline":"511", "name":"Pir8Radio", "userAgent":"signum-miner/1.8.0" }

So when you poll that url, you get like 20 of the above all back to back in a single JSON response. i need to break them out into 20 records not one record with 20 users in it.. Not sure im explaining well.. copy paste the above 20 times back to back and that is what splunk ingests every 2 mins. So in splunk i see this:

Instead of one record with 1 result each for each item miners{}.address , miners{}.addressRS , pendingBalance etc...

Re: I need help from you guru's! Split custom json array.

pir8radio — Fri, 25 Jun 2021 01:39:25 GMT

this post, almost addresses what i'm trying to do, but it only supplies me with the first user record.. https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-json-array-into-multiple-events-with-separate/m-p/139855/highlight/false#M28742 I need it to break out the 20 items in the string, not just give me the first one

Re: I need help from you guru's! Split custom json array.

ITWhisperer — Fri, 25 Jun 2021 08:17:50 GMT

| spath output=miners path=miners{}

This line breaks up the event (assumed to be in field _raw) into a multi-value field called miners - don't forget the braces at the end - these tell the spath command that you want the collection as a multi-value field

| mvexpand miners

This line expands miners so that each value is a separate event

| spath input=miners

This line extract the fields for each user