topic How do I get arbitrary nested key-value pairs from JSON? in Splunk Search

How do I get arbitrary nested key-value pairs from JSON?

mldavis195 — Tue, 28 Mar 2023 20:08:20 GMT

I have some JSON that looks similar to this:

{ "foo": "bar", "x": { "hello": "world", "y": { "A": 400, "B": 500, "C": 300 } } } { "foo": "baz", "x": { "something": "test", "y": { "A": 100, "D": 200, "E": 600 } } }

What I would like is to extract everything in x.y for a sum but the keys are dynamic and I won't know them all in advance:

A	500
B	500
C	300
D	200
E	600

I have been stuck on this one for a while. Can anyone help me?

Re: Get arbitrary nested key-value pairs from JSON

yuanliu — Tue, 28 Mar 2023 17:35:26 GMT

If that's your raw event, you would have fields like x.y.A, x.y.B, etc., already. Just do

| stats sum(x.y.*) as *

If they are in an extracted field, say jsonfield, spath first.

| spath input=jsonfield | stats sum(x.y.*) as *

Re: Get arbitrary nested key-value pairs from JSON

mldavis195 — Tue, 28 Mar 2023 18:25:36 GMT

Thanks, seems so obvious after seeing your solution.