How to convert multiple individual json objects into a nested json object ?

damode1 — Sun, 21 May 2023 23:10:28 GMT

I want to convert some of the below individual json objects in the event into nested single json object like the second example

Current Format

{
    "ID": 1,
    "Timestamp": "2023-05-18T05:07:59.940594300Z",
    "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)",
    "Company": "Microsoft Corporation",
    "TerminalSessionId": 0,
    "UtcTime": "2018-08-20 15:18:59.929",
    "Product": "Microsoft® Windows® Operating System",
}

Expected Format

{
    "ID": 1,
    "Timestamp": "2023-05-18T05:07:59.940594300Z",
    "EventData":{
        "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)",
        "Company": "Microsoft Corporation",
        "TerminalSessionId": 0,
        "UtcTime": "2018-08-20 15:18:59.929",
        "Product": "Microsoft® Windows® Operating System",
    }
}

I have tried to playaround with json functions but unable to figure out how to achieve the above outcome.

Can someone please help ?

Re: How to convert multiple individual json objects into a nested json object ?

kamlesh_vaghela — Mon, 29 May 2023 06:49:13 GMT

@damode1

Can you please try this?

YOUR_SEARCH | spath | eval EventData = json_object("FileVersion", FileVersion,"Company",Company, "TerminalSessionId",TerminalSessionId, "UtcTime",UtcTime, "Product",Product) | eval NewJson = json_object("ID",ID, "Timestamp", Timestamp,"EventData",json(EventData)) | table _raw NewJson

My Sample Search :

| makeresults | eval _raw="{\"ID\": 1,\"Timestamp\": \"2023-05-18T05:07:59.940594300Z\",\"FileVersion\": \"10.0.17134.1 (WinBuild.160101.0800)\",\"Company\": \"Microsoft Corporation\",\"TerminalSessionId\": 0,\"UtcTime\": \"2018-08-20 15:18:59.929\",\"Product\": \"Microsoft® Windows® Operating System\",}" | spath | eval EventData = json_object("FileVersion", FileVersion,"Company",Company, "TerminalSessionId",TerminalSessionId, "UtcTime",UtcTime, "Product",Product) | eval NewJson = json_object("ID",ID, "Timestamp", Timestamp,"EventData",json(EventData)) | table _raw NewJson

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

topic Re: How to convert multiple individual json objects into a nested json object ? in Other Usage

How to convert multiple individual json objects into a nested json object ?

Re: How to convert multiple individual json objects into a nested json object ?