All Apps and Add-ons

How can I parse key value pairs from JSON?

rberman
Path Finder

Let's say I have the following data that I extracted from JSON into a field called myfield. If I were to print out the values of myfield in a table, for each event, I would have an array of a variable number of key value pairs. 

myfield

{"K1":"V1","K2":"V2","K3":"V3",....."KN":"VN"}
{"A":"X"}
{"B":"Y","C":"Z"}

 

How do I extract only the values (and not the keys) as a new array for each one?

The output would look like:

my_processed_field

["V1","V2","V3",....."VN"]
["X"]
["Y","Z"]

 

Help is much appreciated!

Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

rberman
Path Finder

That is in the end how I did it. Thanks @bowesmana

| spath output=myfield json_field_with_my_name_value_pairs{}
| eval keys=json_array_to_mv(json_keys(myfield)), my_processed_field=json_array()
| foreach mode=multivalue keys
     [eval my_processed_field=json_append(my_processed_field, "", json_extract_exact(myfield, <<ITEM>>))]

 

View solution in original post

0 Karma

rberman
Path Finder

That is in the end how I did it. Thanks @bowesmana

| spath output=myfield json_field_with_my_name_value_pairs{}
| eval keys=json_array_to_mv(json_keys(myfield)), my_processed_field=json_array()
| foreach mode=multivalue keys
     [eval my_processed_field=json_append(my_processed_field, "", json_extract_exact(myfield, <<ITEM>>))]

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Here's an example with your data

| makeresults 
| eval _raw="{\"K1\":\"V1\",\"K2\":\"V2\",\"K3\":\"V3\",\"KN\":\"VN\"}##{\"A\":\"X\"}##{\"B\":\"Y\",\"C\":\"Z\"}"
| eval myfield=split(_raw, "##")
| fields - _raw
| mvexpand myfield
| rex field=myfield max_match=0 "\"\w+\":(?<my_processed_field>\"[^\"]*\")"
| eval my_processed_field="[".mvjoin(my_processed_field, ","). "]"

You want the last two lines rex + eval

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You could also do it with somewhat convoluted spath + foreach, given the variability of your field names, but as long as your JSON is simply structured, the rex will capture the field values (including quotes) and then join them all up

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...