Getting Data In

Array extraction with optional elements

psable
Explorer

{
"Version" : 2
Diagnostic: [
{ Name: "Brian", School :"KVG" },
{ Name: "Steve", School :"MKG" },
{ Name: "Gerry" },
{LastName: "Todd", School :"HVD" }
]

How can I get these fields extracted so that it looks like this:

Name Last Name School

Brian - KVG
Steve - MKG
Gerry - -
- Obama HVD

Thanks !

0 Karma
1 Solution

javiergn
Super Champion

Similar to this: https://answers.splunk.com/answers/424422/referring-to-array-elements-by-index.html#answer-424424

| stats count | fields - count
| eval _raw = " {
    \"Version\" : 2
    Diagnostic: [
        { Name: \"Brian\", School :\"KVG\" },
        { Name: \"Steve\", School :\"MKG\" },
        { Name: \"Gerry\" },
        { LastName: \"Todd\", School :\"HVD\" }
    ]
}
"
| rex field=_raw max_match=0 "(?mi)\{\s*(?<keyvalue>.+)\s*\}\,?\n"
| mvexpand keyvalue
| streamstats count as N
| eval keyvalue = split(keyvalue, ",")
| mvexpand keyvalue
| rex field=keyvalue max_match=0 "(?msi)(?<key>\w+)[\s:\"]+(?<value>[^\"]+)"
| eval {key} = value
| fields - keyvalue, key, value
| stats first(*) as * by N, _raw
| fillnull value="-"
| table Name, LastName, School

Output:

alt text

View solution in original post

0 Karma

psable
Explorer

Thank you !

0 Karma

javiergn
Super Champion

Similar to this: https://answers.splunk.com/answers/424422/referring-to-array-elements-by-index.html#answer-424424

| stats count | fields - count
| eval _raw = " {
    \"Version\" : 2
    Diagnostic: [
        { Name: \"Brian\", School :\"KVG\" },
        { Name: \"Steve\", School :\"MKG\" },
        { Name: \"Gerry\" },
        { LastName: \"Todd\", School :\"HVD\" }
    ]
}
"
| rex field=_raw max_match=0 "(?mi)\{\s*(?<keyvalue>.+)\s*\}\,?\n"
| mvexpand keyvalue
| streamstats count as N
| eval keyvalue = split(keyvalue, ",")
| mvexpand keyvalue
| rex field=keyvalue max_match=0 "(?msi)(?<key>\w+)[\s:\"]+(?<value>[^\"]+)"
| eval {key} = value
| fields - keyvalue, key, value
| stats first(*) as * by N, _raw
| fillnull value="-"
| table Name, LastName, School

Output:

alt text

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...