All Apps and Add-ons

How can I parse key value pairs from JSON?

rberman
Path Finder

Let's say I have the following data that I extracted from JSON into a field called myfield. If I were to print out the values of myfield in a table, for each event, I would have an array of a variable number of key value pairs. 

myfield

{"K1":"V1","K2":"V2","K3":"V3",....."KN":"VN"}
{"A":"X"}
{"B":"Y","C":"Z"}

 

How do I extract only the values (and not the keys) as a new array for each one?

The output would look like:

my_processed_field

["V1","V2","V3",....."VN"]
["X"]
["Y","Z"]

 

Help is much appreciated!

Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

rberman
Path Finder

That is in the end how I did it. Thanks @bowesmana

| spath output=myfield json_field_with_my_name_value_pairs{}
| eval keys=json_array_to_mv(json_keys(myfield)), my_processed_field=json_array()
| foreach mode=multivalue keys
     [eval my_processed_field=json_append(my_processed_field, "", json_extract_exact(myfield, <<ITEM>>))]

 

View solution in original post

0 Karma

rberman
Path Finder

That is in the end how I did it. Thanks @bowesmana

| spath output=myfield json_field_with_my_name_value_pairs{}
| eval keys=json_array_to_mv(json_keys(myfield)), my_processed_field=json_array()
| foreach mode=multivalue keys
     [eval my_processed_field=json_append(my_processed_field, "", json_extract_exact(myfield, <<ITEM>>))]

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Here's an example with your data

| makeresults 
| eval _raw="{\"K1\":\"V1\",\"K2\":\"V2\",\"K3\":\"V3\",\"KN\":\"VN\"}##{\"A\":\"X\"}##{\"B\":\"Y\",\"C\":\"Z\"}"
| eval myfield=split(_raw, "##")
| fields - _raw
| mvexpand myfield
| rex field=myfield max_match=0 "\"\w+\":(?<my_processed_field>\"[^\"]*\")"
| eval my_processed_field="[".mvjoin(my_processed_field, ","). "]"

You want the last two lines rex + eval

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You could also do it with somewhat convoluted spath + foreach, given the variability of your field names, but as long as your JSON is simply structured, the rex will capture the field values (including quotes) and then join them all up

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...