All Apps and Add-ons

How can I parse key value pairs from JSON?

rberman
Path Finder

Let's say I have the following data that I extracted from JSON into a field called myfield. If I were to print out the values of myfield in a table, for each event, I would have an array of a variable number of key value pairs. 

myfield

{"K1":"V1","K2":"V2","K3":"V3",....."KN":"VN"}
{"A":"X"}
{"B":"Y","C":"Z"}

 

How do I extract only the values (and not the keys) as a new array for each one?

The output would look like:

my_processed_field

["V1","V2","V3",....."VN"]
["X"]
["Y","Z"]

 

Help is much appreciated!

Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

rberman
Path Finder

That is in the end how I did it. Thanks @bowesmana

| spath output=myfield json_field_with_my_name_value_pairs{}
| eval keys=json_array_to_mv(json_keys(myfield)), my_processed_field=json_array()
| foreach mode=multivalue keys
     [eval my_processed_field=json_append(my_processed_field, "", json_extract_exact(myfield, <<ITEM>>))]

 

View solution in original post

0 Karma

rberman
Path Finder

That is in the end how I did it. Thanks @bowesmana

| spath output=myfield json_field_with_my_name_value_pairs{}
| eval keys=json_array_to_mv(json_keys(myfield)), my_processed_field=json_array()
| foreach mode=multivalue keys
     [eval my_processed_field=json_append(my_processed_field, "", json_extract_exact(myfield, <<ITEM>>))]

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Here's an example with your data

| makeresults 
| eval _raw="{\"K1\":\"V1\",\"K2\":\"V2\",\"K3\":\"V3\",\"KN\":\"VN\"}##{\"A\":\"X\"}##{\"B\":\"Y\",\"C\":\"Z\"}"
| eval myfield=split(_raw, "##")
| fields - _raw
| mvexpand myfield
| rex field=myfield max_match=0 "\"\w+\":(?<my_processed_field>\"[^\"]*\")"
| eval my_processed_field="[".mvjoin(my_processed_field, ","). "]"

You want the last two lines rex + eval

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You could also do it with somewhat convoluted spath + foreach, given the variability of your field names, but as long as your JSON is simply structured, the rex will capture the field values (including quotes) and then join them all up

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...