topic Re: Splitting or searching a MV JSON in Splunk Search

Splitting or searching a MV JSON

moseisleydk — Tue, 29 Sep 2020 17:11:41 GMT

I have a json array like:

How can I search or split that? The search:

index=jira "issues{}.fields.customfield_14028"=521 | head 1 | stats sum("issues{}.fields.customfield_14233") by "issues{}.fields.summary"

gives all issues....also where issues{}.fields.customfield_14028"<>521

Re: Splitting or searching a MV JSON

kamlesh_vaghela — Tue, 12 Dec 2017 12:58:19 GMT

Hi @moseisleydk,

Can you please try this search?

index=jira "issues{}.fields.customfield_14028"=521 
| head 1 
| rename "issues{}.fields.customfield_14233" as customfield_14233, "issues{}.fields.summary" as summary
| eval tempField=mvzip(customfield_14233,summary) 
| stats count by _time,tempField
| eval customfield_14233=mvindex(split(tempField,","),0), summary=mvindex(split(tempField,","),1)
| stats sum(customfield_14233) by summary

Thanks

Re: Splitting or searching a MV JSON

moseisleydk — Tue, 12 Dec 2017 13:08:52 GMT

Hi,

Thanks, it still "ignores" the

"issues{}.fields.customfield_14028"=521

and reports all issues, not only the

customfield_14028: 521

issues.

Kind Regards,

Normann

Re: Splitting or searching a MV JSON

kamlesh_vaghela — Tue, 12 Dec 2017 13:17:39 GMT

Can you please share sample events? use 101010 for same.

Re: Splitting or searching a MV JSON

moseisleydk — Tue, 29 Sep 2020 17:13:43 GMT

Found it after some test and thanks to https://answers.splunk.com/answers/366957/how-do-i-get-splunk-to-extract-nested-json-arrays.html

index=jira | head 1 | spath output=x path=issues{} | fields - _raw | fields x | mvexpand x | spath input=x | rename fields{} as fields | mvexpand fields | search fields.customfield_14028=521 | table key,fields.summary,fields.customfield_12931.value,fields.customfield_12927,fields.customfield_14233,fields.customfield_12932.value,price

Give a nice table for all "events" where fields.customfield_14028=521

Re: Splitting or searching a MV JSON

anishinha — Wed, 30 Sep 2020 03:57:31 GMT

is it possible to extract a field from a result contained in a JSON field?
Ex; result of field payment.log: {"data":{"lancto_dto_list":,"sld_dt":{"lim":10.00,"sld_disp":37.80,"disp":40.80}}}
I need the last field "disp".

Re: Splitting or searching a MV JSON

to4kawa — Fri, 31 Jan 2020 11:59:58 GMT

| makeresults
| eval _raw="payment.log: {\"data\":{\"lancto_dto_list\":,\"sld_dt\":{\"lim\":10.00,\"sld_disp\":37.80,\"disp\":40.80}}}"
| rex "disp.:(?<disp>[\d.]+)"