topic Re: How to convert multiple individual json objects into a nested json object ? in Splunk Search

How to convert multiple individual json objects into a nested json object ?

damode1 — Sun, 21 May 2023 10:55:55 GMT

I want to convert some of the below individual json objects in the event into nested single json object like the second example

Current Format

{ "ID": 1, "Timestamp": "2023-05-18T05:07:59.940594300Z", "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)", "Company": "Microsoft Corporation", "TerminalSessionId": 0, "UtcTime": "2018-08-20 15:18:59.929", "Product": "Microsoft® Windows® Operating System", }

Expected Format

{ "ID": 1, "Timestamp": "2023-05-18T05:07:59.940594300Z", "EventData":{ "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)", "Company": "Microsoft Corporation", "TerminalSessionId": 0, "UtcTime": "2018-08-20 15:18:59.929", "Product": "Microsoft® Windows® Operating System", } }

I have tried to playaround with json functions but unable to figure out how to achieve the above outcome.

Can someone please help ?

Re: How to convert multiple individual json objects into a nested json object ?

yuanliu — Tue, 23 May 2023 07:44:16 GMT

This seems to be the exact question as How to convert multiple individual json objects into a nested json object in an event ? You can checkout answer there. But I'm curious: why the interest all in a sudden? This doesn't seem to be a very practical use of Splunk. Such tasks can be more easily accomplished outside of SPL.

Re: How to convert multiple individual json objects into a nested json object ?

damode1 — Wed, 24 May 2023 00:07:00 GMT

ya sorry about that. my original post was repeatedly getting tagged as spam post for some unknown reason, hence, unfortunately I had to post it from another account.