How to extract and download a field of array from an event?

hantaliu — Thu, 23 Jun 2022 19:02:44 GMT

I have an event which is constructed like the following:

{ name: string, time: string, duration: string, logs: JSONObjects[] }

When I download the event, I just want the logs which is everything inside [] but without the head part which is "{logs:" and the last "}"

To do that how do I construct the search query?

Re: Extract and download a field of array from an event

rymundo_splunk — Thu, 23 Jun 2022 00:38:08 GMT

Hi, you could use something like spath to process the json and then pick the logs array out of the resultant object. Maybe something like this:

|makeresults
| eval json="{\"name\":\"json_name\", \"logs\":[{\"name\":\"log1\"}, { \"name\":\"log2\"}]}",
output_log_array=spath(json,"logs{}"),
output_log_names=spath(json,"logs{}.name")

I added a second example with output_log_names to show how you would extract particular fields within the array json into their own multivalued field.

topic Re: Extract and download a field of array from an event in Splunk Search

How to extract and download a field of array from an event?

Re: Extract and download a field of array from an event