topic Re: How to create a kvpair from two automatically extracted JSON arrays? in Splunk Search

How to create a kvpair from two automatically extracted JSON arrays?

mjones414 — Thu, 02 Jun 2022 22:57:55 GMT

I'm in a situation where by sourcetype, I'm already having a nested JSON array broken into 2 fields: DeviceProperties{}.Name and DeviceProperties{}.Value there are 16 elements in each array.

I'm trying to simply create a field name that is the value of the second element in DeviceProperties{}.Name and the Value is the value of the second element in DeviceProperties{}.Value. In this scenario I think I can get away with just creating a field with just DeviceProperties{1}.Value but I haven't been successful in doing that.

I've tried using the json_extract function, but I think I am getting the syntax wrong, and I havent found any examples yet that are trying to do this exact scenario where the json array was already created as a multivalue field.

Re: How to create a kvpair from two automatically extracted JSON arrays?

rymundo_splunk — Fri, 03 Jun 2022 04:55:40 GMT

Hi, hopefully I understood your question correctly. Can you try this out and see if it's doing what you want it to do?

| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| eval fieldName=mvindex('stuff{}.name',1),
value=mvindex('stuff{}.value',1),
{fieldName}=value
| table *

Re: How to create a kvpair from two automatically extracted JSON arrays?

mjones414 — Mon, 06 Jun 2022 14:32:16 GMT

You are legendarily awesome in my week this week! Thank you! If you're gonna be at .conf2022, I'd love to buy you a drink to show my appreciation.