topic Re: what is the alternative command to use for mvzip? in Dashboards & Visualizations

what is the alternative command to use for mvzip?

anooshac — Tue, 17 Sep 2024 06:13:04 GMT

Hi All, i am using mvzip while working with JSON file. Now in the new Splunk dashboards seems like mvzip command is depricated. Is there any way to extract values from nested JSON apart from mvzip?

Re: what is the alternative command to use for mvzip?

ITWhisperer — Tue, 17 Sep 2024 08:01:01 GMT

What do you mean by "seems like mvzip command is depricated"? Are you getting an error message? How are you trying to use it?

If you don't want to or can't use the mvzip command, a replacement would depend on what it is you are trying to do. Please can you expand on your usecase, with sample events, a description (in non-SPL terms) of what you are trying to achieve, and a representation of your desired output.

Re: what is the alternative command to use for mvzip?

anooshac — Tue, 17 Sep 2024 09:01:07 GMT

ResourceInfo: { ID: "58", User: "abc", NVM: { a: "522523632", b: "80000000", c: "442523632", d: "14", . . }, RAM: { [+] }, ROM: { [+] } }

and for RAM ROM and NVM i want to get the specific data inside them.

component Value

a                      522523632
b    80000000
c                      442523632
d    14

I want to form a table like this for RAM ROM and NVM. And i do it like this. But sometimes i get a error message like field tmp does not exist, even there is data. So i want to avoid mvzip and get this data in some other way. is there way present to deal with JSON data?

Re: what is the alternative command to use for mvzip?

ITWhisperer — Tue, 17 Sep 2024 10:02:47 GMT

Try it this way around

Re: what is the alternative command to use for mvzip?

anooshac — Wed, 18 Sep 2024 04:43:30 GMT

This solution is working and im not seeing any warning message now.

How is this different from mvzip?

May i know why mvzip gives warning if the data is empty?

Re: what is the alternative command to use for mvzip?

ITWhisperer — Wed, 18 Sep 2024 06:47:29 GMT

Perhaps if you can isolate the event or events which are generating the error, you might be able to determine this. However, my guess is that sometimes you end up with one or more nulls from the rex and this is what mvzip doesn't like.

Doing it this way around avoids using mvzip because the mvexpand is done before the fields are split up so the association across the row is maintained and doesn't need to be rebuilt with the mvzip