topic Re: Need some help with a JSON array in Splunk Search

Need some help with a JSON array

ScottW — Thu, 12 Dec 2024 00:44:50 GMT

Hi smart folks. I have the output of a REST API call as seen below. I need to split each of the records as delimited by the {} as it's own event with each of the key:values defined for each record.

[ { "name": "ESSENTIAL", "status": "ENABLED", "compliance": "COMPLIANT", "consumptionCounter": 17, "daysOutOfCompliance": "-", "lastAuthorization": "Dec 11,2024 07:32:21 AM" }, { "name": "ADVANTAGE", "status": "ENABLED", "compliance": "EVALUATION", "consumptionCounter": 0, "daysOutOfCompliance": "-", "lastAuthorization": "Jul 09,2024 22:49:25 PM" }, { "name": "PREMIER", "status": "ENABLED", "compliance": "EVALUATION", "consumptionCounter": 0, "daysOutOfCompliance": "-", "lastAuthorization": "Aug 10,2024 21:10:44 PM" }, { "name": "DEVICEADMIN", "status": "ENABLED", "compliance": "COMPLIANT", "consumptionCounter": 2, "daysOutOfCompliance": "-", "lastAuthorization": "Dec 11,2024 07:32:21 AM" }, { "name": "VM", "status": "ENABLED", "compliance": "COMPLIANT", "consumptionCounter": 2, "daysOutOfCompliance": "-", "lastAuthorization": "Dec 11,2024 07:32:21 AM" } ]

Thanks in advance for any help you all might offer to get me down the right track.

Re: Need some help with a JSON array

richgalloway — Thu, 12 Dec 2024 00:47:32 GMT

It would help to know what you've tried already so we don't waste time on that.

Consider these props settings

[mysourcetype] DATETIME_CONFIG = current SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\{ TRANSFORMS-parse_mysourcetype = parse_mysourcetype

with these transforms:

[parse_mysourcetype] REGEX = "([^"]+)":"([^"]+) FORMAT = $1::$2

Re: Need some help with a JSON array

bowesmana — Thu, 12 Dec 2024 01:12:41 GMT

Assuming this is the output of a search, then make the search do this with that data - this assumes raw is a field containing that data

Re: Need some help with a JSON array

ScottW — Thu, 12 Dec 2024 13:59:28 GMT

Thank you for the help. This got me to the following:

I am hoping to get to the point where the individual fields like "name" and "consumptionCounter" become their own fields so that I can do things like trend over time, average, etc.

Re: Need some help with a JSON array

ScottW — Thu, 12 Dec 2024 14:06:09 GMT

Hi Rich,

I am starting from scratch here and am not a Splunk whisperer, so really starting from ground zero.

Re: Need some help with a JSON array

ScottW — Thu, 12 Dec 2024 14:33:33 GMT

This got me on the right track and let me to the following: