Getting Data In

Array extraction with optional elements

psable
Explorer

{
"Version" : 2
Diagnostic: [
{ Name: "Brian", School :"KVG" },
{ Name: "Steve", School :"MKG" },
{ Name: "Gerry" },
{LastName: "Todd", School :"HVD" }
]

How can I get these fields extracted so that it looks like this:

Name Last Name School

Brian - KVG
Steve - MKG
Gerry - -
- Obama HVD

Thanks !

0 Karma
1 Solution

javiergn
Super Champion

Similar to this: https://answers.splunk.com/answers/424422/referring-to-array-elements-by-index.html#answer-424424

| stats count | fields - count
| eval _raw = " {
    \"Version\" : 2
    Diagnostic: [
        { Name: \"Brian\", School :\"KVG\" },
        { Name: \"Steve\", School :\"MKG\" },
        { Name: \"Gerry\" },
        { LastName: \"Todd\", School :\"HVD\" }
    ]
}
"
| rex field=_raw max_match=0 "(?mi)\{\s*(?<keyvalue>.+)\s*\}\,?\n"
| mvexpand keyvalue
| streamstats count as N
| eval keyvalue = split(keyvalue, ",")
| mvexpand keyvalue
| rex field=keyvalue max_match=0 "(?msi)(?<key>\w+)[\s:\"]+(?<value>[^\"]+)"
| eval {key} = value
| fields - keyvalue, key, value
| stats first(*) as * by N, _raw
| fillnull value="-"
| table Name, LastName, School

Output:

alt text

View solution in original post

0 Karma

psable
Explorer

Thank you !

0 Karma

javiergn
Super Champion

Similar to this: https://answers.splunk.com/answers/424422/referring-to-array-elements-by-index.html#answer-424424

| stats count | fields - count
| eval _raw = " {
    \"Version\" : 2
    Diagnostic: [
        { Name: \"Brian\", School :\"KVG\" },
        { Name: \"Steve\", School :\"MKG\" },
        { Name: \"Gerry\" },
        { LastName: \"Todd\", School :\"HVD\" }
    ]
}
"
| rex field=_raw max_match=0 "(?mi)\{\s*(?<keyvalue>.+)\s*\}\,?\n"
| mvexpand keyvalue
| streamstats count as N
| eval keyvalue = split(keyvalue, ",")
| mvexpand keyvalue
| rex field=keyvalue max_match=0 "(?msi)(?<key>\w+)[\s:\"]+(?<value>[^\"]+)"
| eval {key} = value
| fields - keyvalue, key, value
| stats first(*) as * by N, _raw
| fillnull value="-"
| table Name, LastName, School

Output:

alt text

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...