How do I change field names (extracted field name) to field values?

vasugazula — Wed, 30 Sep 2020 05:36:23 GMT

I have a json structure that contains an object map:

{
  "correlation_id": "f9535d13-f75b-4dd7-8c39-1e77b1559afe",
  "targeting_data": [
    {
      "attribute_values": {
        "1013": "005",
        "2056": "07",
        "2057": "01",
        "2058": "03",
        "2060": "02",
        "2065": "01",
        "2075": "04",
        "2080": "03",
        "2081": "01",
        "DMA": "803",
        "RECTYPE": "HD",
        "RECVCNT": "6",
        "STATE": "CA",
        "SVCPKGTIER": "5"
      },
      "origin": null
    }
  ],
  "timestamp": "2020-06-02T00:02:09.257+00:00",
  "zone_target_area": "195"
}

How do i take the fields extracted as targeting_data{}.attribute_values.1013, targeting_data{}.attribute_values.2056 and output the field names (1013, 2056) as values. I would like for my output to be a list of the map's keys.

Re: How do I change field names (extracted field name) to field values?

kamlesh_vaghela — Tue, 02 Jun 2020 05:41:53 GMT

@vasugazula

Can you please try this? You will have your values in map_s_keys field.

YOUR_SEARCH | eval map_s_keys="" 
| foreach targeting_data{}.attribute_values.*  [ eval map_s_keys=if(map_s_keys="","<<MATCHSTR>>",  map_s_keys.","."<<MATCHSTR>>") ] | table map_s_keys

Sample Search:

| makeresults | eval _raw="{\"correlation_id\": \"f9535d13-f75b-4dd7-8c39-1e77b1559afe\",\"targeting_data\": [{\"attribute_values\": {\"1013\": \"005\",\"2056\": \"07\",\"2057\": \"01\",\"2058\": \"03\",\"2060\": \"02\",\"2065\": \"01\",\"2075\": \"04\",\"2080\": \"03\",\"2081\": \"01\",\"DMA\": \"803\",\"RECTYPE\": \"HD\",\"RECVCNT\": \"6\",\"STATE\": \"CA\",\"SVCPKGTIER\": \"5\"},\"origin\": null}],\"timestamp\": \"2020-06-02T00:02:09.257+00:00\",\"zone_target_area\": \"195\"}" | extract | eval map_s_keys="" 
| foreach targeting_data{}.attribute_values.*  [ eval map_s_keys=if(map_s_keys="","<<MATCHSTR>>",  map_s_keys.","."<<MATCHSTR>>") ] | table map_s_keys

Thanks

topic How do I change field names (extracted field name) to field values? in Splunk Search

How do I change field names (extracted field name) to field values?

Re: How do I change field names (extracted field name) to field values?