which is more better structure when use json array

ktaeil — Fri, 20 Oct 2023 00:42:33 GMT

when i made a log for HEC with json array, im not sure what is more better way to use spl.

can someone advise me please?

way 1.

{host: 'test'

lists : [{

id: ' list1'

ip: '192.168.0.1'

device: 'laptop'

value: 123

{

id: ' list2'

ip: '192.168.0.2'

device: 'phone'

value: 1223

{

id: ' list3'

ip: '192.168.0.3'

device: 'desktop'

value: 99

]}

way2.

{host: 'test'

list1 :{

id: ' list1'

ip: '192.168.0.1'

device: 'laptop'

value: 123

}

list2 : {

id: ' list2'

ip: '192.168.0.2'

device: 'phone'

value: 1223

list3: {

id: ' list3'

ip: '192.168.0.3'

device: 'desktop'

value: 99

]}

Re: which is more better structure when use json array

yuanliu — Fri, 20 Oct 2023 01:33:30 GMT

It is interesting that you pose the question in regard to SPL instead of a data structure consideration. But still, while array is a viable structure for many applications, SPL is not the only language that has to go to extra length to handle. If you have a choice, and if you don't care much about front-end compute, hash is easier on SPL. (And again, easier in some use cases with other languages.)

I do want to suggest, though, you drop the nested listX.id node because that is redundant. (Lastly, I also recommend that you illustrate with compliant JSON. This makes volunteers work easier.)

{"host": "test",

"list1" :{

"ip": "192.168.0.1",

"device": "laptop",

"value": 123

"list2" : {

"ip": "192.168.0.2",

"device": "phone",

"value": 1223

"list3": {

"ip": "192.168.0.3",

"device": "desktop",

"value": 99

}

topic which is more better structure when use json array in Splunk Search

which is more better structure when use json array

Re: which is more better structure when use json array