topic How to parse JSON List in Splunk Search

How to parse JSON List

srajabi — Wed, 20 Sep 2023 00:35:36 GMT

Hey I have the following query:

```

| makeresults | eval prediction_str_body="[{'stringOutput':'Alpha','doubleOutput':0.52},{'stringOutput':'Beta','doubleOutput':0.48}]"

```

But no matter what I do, I can't seem to extract each element of the list and turn it into it's own event.

I'd ideally like a table afterwards of the sum of each value:

Alpha: 0.52
Beta: 0.48

For all rows.

Thanks!

Re: How to parse JSON List

yuanliu — Wed, 20 Sep 2023 01:03:26 GMT

Pro tip: It is great that you are using makeresults to post simulation. But do not mangle JSON.

The command you are looking for is mvexpand.

| makeresults | eval prediction_str_body="[{\"stringOutput\":\"Alpha\",\"doubleOutput\":0.52},{\"stringOutput\":\"Beta\",\"doubleOutput\":0.48}]" | spath input=prediction_str_body path={} | mvexpand {} | spath input={}

Your sample gives

doubleOutput	stringOutput	{}
0.48	Beta	{"stringOutput":"Beta","doubleOutput":0.48}

Hope this helps.

Re: How to parse JSON List

srajabi — Wed, 20 Sep 2023 01:57:05 GMT

Ah wonderful, thanks so much!