Getting Data In

Array extraction with optional elements

psable
Explorer

{
"Version" : 2
Diagnostic: [
{ Name: "Brian", School :"KVG" },
{ Name: "Steve", School :"MKG" },
{ Name: "Gerry" },
{LastName: "Todd", School :"HVD" }
]

How can I get these fields extracted so that it looks like this:

Name Last Name School

Brian - KVG
Steve - MKG
Gerry - -
- Obama HVD

Thanks !

0 Karma
1 Solution

javiergn
Super Champion

Similar to this: https://answers.splunk.com/answers/424422/referring-to-array-elements-by-index.html#answer-424424

| stats count | fields - count
| eval _raw = " {
    \"Version\" : 2
    Diagnostic: [
        { Name: \"Brian\", School :\"KVG\" },
        { Name: \"Steve\", School :\"MKG\" },
        { Name: \"Gerry\" },
        { LastName: \"Todd\", School :\"HVD\" }
    ]
}
"
| rex field=_raw max_match=0 "(?mi)\{\s*(?<keyvalue>.+)\s*\}\,?\n"
| mvexpand keyvalue
| streamstats count as N
| eval keyvalue = split(keyvalue, ",")
| mvexpand keyvalue
| rex field=keyvalue max_match=0 "(?msi)(?<key>\w+)[\s:\"]+(?<value>[^\"]+)"
| eval {key} = value
| fields - keyvalue, key, value
| stats first(*) as * by N, _raw
| fillnull value="-"
| table Name, LastName, School

Output:

alt text

View solution in original post

0 Karma

psable
Explorer

Thank you !

0 Karma

javiergn
Super Champion

Similar to this: https://answers.splunk.com/answers/424422/referring-to-array-elements-by-index.html#answer-424424

| stats count | fields - count
| eval _raw = " {
    \"Version\" : 2
    Diagnostic: [
        { Name: \"Brian\", School :\"KVG\" },
        { Name: \"Steve\", School :\"MKG\" },
        { Name: \"Gerry\" },
        { LastName: \"Todd\", School :\"HVD\" }
    ]
}
"
| rex field=_raw max_match=0 "(?mi)\{\s*(?<keyvalue>.+)\s*\}\,?\n"
| mvexpand keyvalue
| streamstats count as N
| eval keyvalue = split(keyvalue, ",")
| mvexpand keyvalue
| rex field=keyvalue max_match=0 "(?msi)(?<key>\w+)[\s:\"]+(?<value>[^\"]+)"
| eval {key} = value
| fields - keyvalue, key, value
| stats first(*) as * by N, _raw
| fillnull value="-"
| table Name, LastName, School

Output:

alt text

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...