Display nested JSON as table

[theiamdude]

I am trying to implement system package tracking in Splunk using Ansible facts collections but I am having some difficulties reading message received.

The message received is:

    {   [-] 
         @timestamp:     2018-11-06T22:07:46.062Z   
         ansible_facts: {   [+] 
        }   
         ansible_facts_modified:     2018-11-06T22:07:46.027218+00:00   
         cluster_host_id:    awx    
         host:   awx    
         host_name:  192.168.1.120  
         inventory_id:   2  
         job_id:     48 
         level:  INFO   
         logger_name:    awx.analytics.system_tracking  
         message:    New fact for inventory Local host 192.168.1.120    
         tower_uuid:    
         type:   splunk 
    }

Most of the information I need is inside the ansible_facts block and I am able to get most of them except 2 areas which have a different structure. The structure is the same for both of those.

{
    "ansible_facts": {
        "packages": {
            "libbz2-1.0": [{
                "version": "1.0.6-5",
                "source": "apt",
                "arch": "amd64",
                "name": "libbz2-1.0"
            }],
            "patch": [{
                "version": "2.7.1-4ubuntu1",
                "source": "apt",
                "arch": "amd64",
                "name": "patch"
            }],
            "gcc-4.8-base": [{
                    "version": "4.8.2-19ubuntu1",
                    "source": "apt",
                    "arch": "amd64",
                    "name": "gcc-4.8-base"
                }
            ]
        }
    }
}

Further down, i would like to print any changes of package version through time but at this stage I am trying to print the list of packages and their corresponding versions in table.

I tried the following search, but it's not returning any results.

spath input=_raw | rename ansible_facts.packages{}.* as *
 | eval values=mvzip(mvzip(mvzip(name,version),release),arch)
 | mvexpand values| eval values = split(values,",")
 | eval name=mvindex(values,0)|eval version=mvindex(values,1) |eval release=mvindex(values,2)|eval arch=mvindex(values,3)
 | table name version release arch

Any help would be greatly appreciated.

[pramit46]

@theiamdude, except for the ansible_facts block, rest of the text does not look like properly formatted in json.
What do you get when you run spath? does it show the ansible_facts in the fields section on the left side panel?

[theiamdude]

I am able to some of the value in the fields section.

I am able to get other value under ansible_facts block (below is not the entire block):
{
"ansible_facts": {
"ansible_distribution": "OracleLinux",
"ansible_distribution_version": "6.9",
"ansible_architecture": "x86_64",
"ansible_os_family": "RedHat",
"ansible_kernel": "3.8.13-118.21.4.el6uek.x86_64",
"facter_processorcount": 2,
"facter_memorysize": "7.80 GB",
"facter_uptime": "34 days",
"ansible_bios_version": "4.4.4OVM",
"ansible_bios_date": "04/18/2018",
"ansible_hostname": "localhost",
"ansible_pkg_mgr": "yum",
"ansible_user_id": "testapp",
"packages": {
"libbz2-1.0": [{
"version": "1.0.6-5",
"source": "apt",
"arch": "amd64",
"name": "libbz2-1.0"
}],
"patch": [{
"version": "2.7.1-4ubuntu1",
"source": "apt",
"arch": "amd64",
"name": "patch"
}],
"gcc-4.8-base": [{
"version": "4.8.2-19ubuntu1",
"source": "apt",
"arch": "amd64",
"name": "gcc-4.8-base"
}
]
},
"services": {
"blk-availability": {
"source": "sysv",
"state": "running",
"name": "blk-availability"
},
"lvm2-lvmetad": {
"source": "sysv",
"state": "running",
"name": "lvm2-lvmetad"
},
"acpid": {
"source": "sysv",
"state": "running",
"name": "acpid"
}
}
}
}

When I run the following search I am able to get it in a table:
index=dev__inf source=AWX_source | spath logger_name | search logger_name="awx.analytics.system_tracking"
| spath input=_raw path="ansible_facts.ansible_distribution" output=linux_distribution
| spath input=_raw path="ansible_facts.ansible_distribution_version" output=distribution_version
| spath input=_raw path="ansible_facts.ansible_architecture" output=architecture
| spath input=_raw path="ansible_facts.ansible_os_family" output=os_family
| spath input=_raw path="ansible_facts.ansible_kernel" output=kernel
| spath input=_raw path="ansible_facts.facter_processorcount" output=processorcount
| spath input=_raw path="ansible_facts.facter_memorysize" output=memorysize
| spath input=_raw path="ansible_facts.ansible_bios_version" output=bios_version
| spath input=_raw path="ansible_facts.ansible_bios_date" output=bios_date
| spath input=_raw path="ansible_facts.ansible_hostname" output=hostname
| spath input=_raw path="ansible_facts.ansible_pkg_mgr" output=pkg_mgr
| spath input=_raw path="ansible_facts.ansible_user_id" output=user_id
| table hostname user_id architecture os_family linux_distribution distribution_version kernel pkg_mgr bios_version bios_date processorcount memorysize

hostname	user_id	architecture	os_family	linux_distribution	distribution_version	kernel	pkg_mgr	bios_version	bios_date	processorcount	memorysize
localhost	testapp	x86_64	RedHat	OracleLinux	6.9	3.8.13	yum	4.4.4OVM	04/18/2018	2	7.80 GB