topic Re: How to split Json array using Splunk Search commands?? in Splunk Search

How to split Json array using Splunk Search commands??

ajayabburi508 — Sat, 17 Feb 2018 07:48:50 GMT

My Query is :

|inputlookup geo_jj | eval types = "{\"geom\": " + geom + "}" | spath input=types

i got output in geom column is :

geom

{"type":"MultiPolygon","coordinates":[[[[-105.8203125,31.052934646606445],[-105.8203125,48.806861877441406],[-88.06640625,48.806861877441406],[-88.06640625,31.052934646606445],[-105.8203125,31.052934646606445]]]]}

But i want output like this

value1 value2
-105.8203125 31.052934646606445
-105.8203125 48.806861877441406
-88.06640625 48.806861877441406
-88.06640625 31.052934646606445
-105.8203125 31.052934646606445

Please help me for this

Re: How to split Json array using Splunk Search commands??

493669 — Sat, 17 Feb 2018 08:12:11 GMT

Hi @ajayabburi508,
try this regex:

|rex max_match=0 field=geom "\[(?<value1>-[^,]+),(?<value2>[^]]+)"

after this to separate multivalue fields you can try :

|eval combined=mvzip(value1,value2)| mvexpand combined
 | makemv combined delim=","  
|eval lat=mvindex(combined,0), lon=mvindex(combined,1)

Re: How to split Json array using Splunk Search commands??

ajayabburi508 — Sat, 17 Feb 2018 09:24:55 GMT

Thanks 493669 alot ,it is working good

Re: How to split Json array using Splunk Search commands??

493669 — Sat, 17 Feb 2018 09:48:37 GMT

Glad to help:) please accept the answer so that it will no longer open.

Re: How to split Json array using Splunk Search commands??

ajayabburi508 — Sat, 17 Feb 2018 10:31:35 GMT

Accepted bro