topic Re: Json field extract in Splunk Search

Json field extract

priyangshupal — Thu, 30 Sep 2021 07:03:38 GMT

I have a json like this:

{ "A": [ { "B": [ { "status": "2", "value": "1" }, { "status": "1", "value": "2" }, { "status": "3", "value": "4" }, { "status": "5", "value": "8" } ] } ] }

I want to extract the field value.

I tried doing

spath input=field_name output=value path=A{0}.B{}.value

but it's not working

Pls help

Re: Json field extract

PickleRick — Thu, 30 Sep 2021 07:30:12 GMT

Works for me.

| makeresults 
| eval json="{
\"A\": [
{
\"B\": [
{
\"status\": \"2\",
\"value\": \"1\"
},
{
\"status\": \"1\",
\"value\": \"2\"
},
{
\"status\": \"3\",
\"value\": \"4\"
},
{
\"status\": \"5\",
\"value\": \"8\"
}
]
}
]
}"
| spath input=json path="A{}.B{}.value" output=vals

You forgot to put the path in quotes.