Find first matching node of json

nainil0683 — Fri, 27 Sep 2024 01:27:20 GMT

Hi,

Based on the following json document, I want to find the value of "Geography" where City is input.

Here is the json:

{ "Company" : "Microsoft", "Cloud" : "Azure", "DataCenters" : [ { "Geography" : "USA", "Region" : "East", "City": "New York" }, { "Geography" : "India", "Region" : "West", "City": "Ahmedabad" }, { "Geography" : "USA", "Region" : "West", "City": "San Fransisco" }, { "Geography" : "South Africa", "Region" : "West", "City": "Capetown" } ] }

Can somebody please help me fetch this information. Thanks.

Re: Find first matching node of json

yuanliu — Fri, 27 Sep 2024 01:53:29 GMT

Assuming you already have a token $City_tok$ from the input, mvexpand is the most traditional way to do it

| spath path=DataCenters{} | mvexpand DataCenters{} | spath input=DataCenters{} | whree City == "$City_tok$"

If mvexpand is a problem in your environment, there are other ways.

topic Find first matching node of json in Splunk Search

Find first matching node of json

Re: Find first matching node of json