topic Re: How to extract the first element from the JSON element based on a field match? in Splunk Search

How to extract the first element from the JSON element based on a field match?

Chandra — Fri, 07 Jul 2023 18:39:20 GMT

I want to extract the json object based on a single field match from below string message.

payload ::[{"name","suman", "age":"22"},{"name","raman", "age":"32"}]

If the age is 22 then print {"name","suman", "age":"22"}

Re: How to extract the first element from the JSON element based on a field match?

yuanliu — Fri, 07 Jul 2023 19:10:26 GMT

Note your JSON illustration is invalid. I assume you meant

{"payload":[{"name":"suman", "age":"22"},{"name":"raman", "age":"32"}]}

(This means that you have fields like payload{}.name and payload{}.age.) You can use mvexpand then search, like

| spath path=payload{} | mvexpand payload{} | spath input=payload{} | where age == "22"

Or, you can use mvfind with mvindex, like

| eval match_name = mvindex('payload{}.name', mvfind('payload{}.age', "22")) | eval match = json_object("age", "22", "name", match_name)

Re: How to extract the first element from the JSON element based on a field match?

ITWhisperer — Fri, 07 Jul 2023 19:12:53 GMT

| rex "(?<nameage>\{\"name\",\"[^\"]+\", \"age\":\"22\"\})"

However, given that this is not valid JSON, you might want to change the first comma (,) to a colon (:) to match JSON format. You also might need to include some white spaces (\s) in the match strings. (Since you have obviously provided a dummy example, there may be other tweaks you need to make!)