How to Parse Json array with inner condition?

ofer_s — Wed, 13 Apr 2022 15:12:59 GMT

I cant seem to find an example parsing a json array with no parent.

Meaning, I need to parse: [{"key1":"value2}, {"key1", "value2}].

But I only see examples with: "{"MyList" : [{"key1":"value2}, {"key1", "value2}]}

This is the json I have:

[{ "id": "123", "percentage": 25.0, "active": true, "second_id": "456", "creation time": "2022-04-13T09:30:06.517", "event_age": { "hours": 3, "minutes": 4, "seconds": 2 } }, { "id": "789", "percentage": 56.0, "active": true, "second_id": "222", "creation time": "2022-04-13T09:30:06.517", "event_age": { "hours": 6, "minutes": 2, "seconds": 2 } }]

I need to filter only the records which their event_age>4 and present it in a table.

id	percentage	active	second_id	creation time	event_age
789	56	true	222	2022-04-13T09:30:06.517	hours: 6, minutes :6, seconds: 2

Thanks!

Re: Parse Json array with inner condition

kamlesh_vaghela — Wed, 13 Apr 2022 13:08:07 GMT

@ofer_s

You can extract your required values using below search. Here, you need to change where condition as per your requirement. I have

YOUR_SEARCH | spath path={} output=raw | mvexpand raw | rename raw as _raw | spath | where 'event_age.hours' > 4

My Sample Search :

| makeresults | eval _raw="[{\"id\": \"123\",\"percentage\": 25.0,\"active\": true,\"second_id\": \"456\",\"creation time\": \"2022-04-13T09:30:06.517\",\"event_age\": {\"hours\": 3,\"minutes\": 4,\"seconds\": 2}}, {\"id\": \"789\",\"percentage\": 56.0,\"active\": true,\"second_id\": \"222\",\"creation time\": \"2022-04-13T09:30:06.517\", \"event_age\": {\"hours\": 6,\"minutes\": 2,\"seconds\": 2}}]" |rename comment as "Upto now is for sample data only" | spath path={} output=raw | mvexpand raw | rename raw as _raw | spath | where 'event_age.hours' > 4

Thanks
KV

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

topic How to Parse Json array with inner condition? in Splunk Search

How to Parse Json array with inner condition?

Re: Parse Json array with inner condition