topic Re: how to extract extract wildcard key name in nested json in Splunk Search

how to extract extract wildcard key name in nested json

crazymonkey — Tue, 02 Nov 2021 22:36:29 GMT

Sample JSON

{ message: { application: hello deploy: { X: { A: { QPY: 14814 } } Y: { A: { BWQ: 10967 MQP: 1106 } } } ABC: 4020 DEF: 1532 } severity: info }

I'm trying to extract key names and values under message.deploy.Y.A (key names are not static)
Goal is to put them in a line chart and track values over time.

tried foreach but don't know how to use eval. Can someone help please

| foreach message.deploy.Y.A.*

Re: how to extract extract wildcard key name in nested json

bowesmana — Wed, 03 Nov 2021 03:23:14 GMT

Does this work?

| rename message.deploy.Y.A.* as XX_* | fields _time XX_* | timechart fixedrange=f max(XX_*) as *

i.e. it takes all the Y.A fields and renames them to XX_* and gets rid of all other fields other than those and time. Then plots max value over time of the XX_ values.

Re: how to extract extract wildcard key name in nested json

crazymonkey2 — Fri, 19 Nov 2021 18:18:26 GMT

thank you, that works but don't wan't max for the day.
If I do table, how to not show on chart xx_1, xx_2 and xx_3, rather show 1, 2 and 3

| rename message.deploy.Y.A.* as xx_* | table _time xx_*

Re: how to extract extract wildcard key name in nested json

yuanliu — Sun, 21 Nov 2021 02:31:19 GMT

If I do table, how to not show on chart xx_1, xx_2 and xx_3, rather show 1, 2 and 3

Have you tried

| rename message.deploy.Y.A.* as * | table _time *

Re: how to extract extract wildcard key name in nested json

bowesmana — Sun, 21 Nov 2021 21:12:30 GMT

Just add

| rename xx_* as *

which is basically what the timechart max(XX_*) as *, i.e. the implicit rename

Re: how to extract extract wildcard key name in nested json

crazymonkey2 — Tue, 23 Nov 2021 22:36:58 GMT

I tried that, table shows contents of nested json that don't match

message.deploy.Y.A

Re: how to extract extract wildcard key name in nested json

crazymonkey2 — Wed, 24 Nov 2021 16:25:48 GMT

I figured it out