topic Re: display all values of JSON field in a table if you don't know the structure of the json in Splunk Search

display all values of JSON field in a table if you don't know the structure of the json

dasaed — Thu, 20 Jan 2022 15:20:46 GMT

I have a JSON with a field containing another object, but this object varies depending on type. For example, you may have these 3 logs under the same sourcetype/index:

{ "Log":"something","user": "me" ,"type":"car", "data": {"case1":"something"} }
{ "Log":"something","user": "me" ,"type":"apple", "data": {"fruity":"yummy"} }
{ "Log":"something","user": "me","type":"Cauliflower", "data":{"veggie":"eww", "fact":"good for you"} }

and I want a table query to look something like this:
user | data
me | {"case1":"something"}
me | {"fruity":"yummy"}
me | {"veggie":"eww", "fact":"good for you"}

I tried the following query:
index=mylog | table user,data
but my results usually look like this (with either nulls or straight up empty):
user | data
me | null
me |
me | null

data itself may sometimes be very long, but I would still like to see its entire output in the table. How can I go about this?

Re: display all values of JSON field in a table if you don't know the structure of the json

richgalloway — Thu, 20 Jan 2022 16:02:49 GMT

Have you tried index=mylog | table user,data.* ?

Re: display all values of JSON field in a table if you don't know the structure of the json

ITWhisperer — Thu, 20 Jan 2022 17:23:29 GMT

| spath path=user | spath path=data | table user data

Re: display all values of JSON field in a table if you don't know the structure of the json

yuanliu — Sat, 22 Jan 2022 09:54:21 GMT

path=user is not necessary for this dataset. But that's a great illustration of path option in spath!