topic Re: json to table in Splunk Search

json to table

vinod0313 — Mon, 24 Aug 2020 11:03:21 GMT

Hello

I have a log like below,which is having JSON object

FEATURES=[
{
"featureName":"TOKEN_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate the JWT token"
},
{
"featureName":"REQUETS_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate request URL"
},
{
"featureName":"REQUEST_PAYLOAD_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate request body"
},
{
"featureName":"RESPONSE_PAYLOAD_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate response body"
},
{
"featureName":"AOP",
"addedIn":"1.0.6",
"description":"This feature is used to check method execution time"
},
{
"featureName":"TIBCO_COMMUNICATOR",
"addedIn":"1.0.8",
"description":"This feature is used to connect Benefits service "
},
{
"featureName":"SECRETS_SECURE",
"addedIn":"1.0.7",
"description":"This feature is used to Validate"
}
]

I want the out put table should be as shown in below

featureName addedIn description

TOKEN_VALIDATION 1.0.7 This feature is used to Validate the JWT token
REQUETS_VALIDATION 1.0.7 This feature is used to Validate request URL
REQUEST_PAYLOAD_VALIDATION 1.0.7 This feature is used to Validate request body
RESPONSE_PAYLOAD_VALIDATION 1.0.7 This feature is used to Validate response body
AOP 1.0.6 This feature is used to check method execution time
TIBCO_COMMUNICATOR 1.0.8 This feature is used to connect Benefits service
SECRETS_SECURE 1.0.7 This feature is used to Validate SECRETS

Re: json to table

to4kawa — Mon, 24 Aug 2020 11:07:54 GMT

index=_internal | head 1 | fields _raw | eval FEATURES="[{\"featureName\":\"TOKEN_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate the JWT token\"},{\"featureName\":\"REQUETS_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate request URL\"},{\"featureName\":\"REQUEST_PAYLOAD_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate request body\"},{\"featureName\":\"RESPONSE_PAYLOAD_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate response body\"},{\"featureName\":\"AOP\",\"addedIn\":\"1.0.6\",\"description\":\"This feature is used to check method execution time\"},{\"featureName\":\"TIBCO_COMMUNICATOR\",\"addedIn\":\"1.0.8\",\"description\":\"This feature is used to connect Benefits service \"},{\"featureName\":\"SECRETS_SECURE\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate\"}]"
| spath input=FEATURES {} output=raw
| stats count by raw
| spath input=raw
| table featureName,addedIn,description

Re: json to table

vinod0313 — Mon, 24 Aug 2020 12:20:44 GMT

I am getting result as shown below

i am getting the order in alphabetical order.

if it come as in json object order,I mean Token_validation is first,Request_validation second so on.

But thanks for the solution

Re: json to table

to4kawa — Mon, 24 Aug 2020 12:23:04 GMT

| stats count by raw → | mvexpand raw