Extract Json data

[spyme72]

i want to extract all the attributes in the following Json string and use it to populate a dropdown.

This is the first time i am working with Json string hence confused on how to use spath to extract all the attributes. i would have used rex if it was a string, please help.

{[-]
DIR_CLIENT_ORAHOME : "/oracle/C08/920_64",
DIR_CT_RUN : "/usr/sap/C08/SYS/exe/run",
DIR_EXECUTABLE : "/usr/sap/C08/DVEBMGS15/exe",
DIR_ORAHOME : "/oracle/C08/920_64",
DIR_PUT : "/usr/sap/SUM/abap",
DIR_SERVER_ORAHOME : "/oracle/C08/920_64",
INSTANCE_NAME : "DVEBMGS15",
OS_UNICODE : "uc",
PHYS_MEMSIZE : "16384",
SAPDBHOST : "stluc08cnb01",
SAPGLOBALHOST : "stc08a00",
SAPSYSTEM : "15",
SAPSYSTEMNAME : "C08",
abap/atrasizequota : "50000",
abap/buffersize : "3148000",
abap/fieldexit : "yes",
abap/heap_area_dia : "3000000000",
abap/heap_area_nondia : "5368709120",
abap/heap_area_total : "10737418240",
abap/heaplimit : "50000000",
abap/shared_objects_size_MB : "25",
alert/MONI_SEGM_SIZE : "80000000",
auth/auth_number_in_userbuffer : "9000",
auth/no_check_in_some_cases : "Y",
auth/object_disabling_active : "N",
auth/tcodes_not_checked : "null",
csa/second_language : "E",
dbms/type : "ora",
dbs/ora/plan_table : "UH",
dbs/ora/tnsname : "c08-scan/stc08a00_C08_15",
em/global_area_MB : "2048",
em/initial_size_MB : "14336",
em/max_size_MB : "24576",
enque/table_size : "65536",
es/implementation : "std",
exe/icmbnd : "$(DIR_CT_RUN)/icmbnd",
gw/cpic_timeout : "40",
gw/max_conn : "2000",
gw/max_conn_per_wp : "20",
gw/max_overflow_size : "25000000",
gw/max_sys : "2000",
icm/HTTP/logging_0 : "PREFIX=/, LOGFILE=icmhttp.log, LOGFORMAT=SAPSMD, MAXSIZEKB=10240, SWITCHTF=day, FILEWRAP=on",
icm/host_name_full : "stc08a00.monsanto.com",
icm/keep_alive_timeout : "90",
icm/max_conn : "16384",
icm/max_sockets : "16384",
icm/max_threads : "250",
icm/min_threads : "100",
icm/req_queue_len : "6000",
icm/server_port_0 : "PROT=HTTPS,PORT=80$$",
icm/server_port_1 : "PROT=SMTP,PORT=0,PROCTIMEOUT=1200,TIMEOUT=60",
install/umask : "002",
ipc/shm_psize_10 : "224000000",
ipc/shm_psize_40 : "734000000",
itsp/Security/allow_designs_from : "myhost,stcepa00.monsanto.com,cep.monsanto.com",
login/accept_sso2_ticket : "1",
login/create_sso2_ticket : "1",
login/failed_user_auto_unlock : "0",
login/fails_to_session_end : "3",
login/fails_to_user_lock : "6",
login/min_password_digits : "1",
login/min_password_letters : "1",
login/min_password_lng : "6",
login/min_password_specials : "1",
login/no_automatic_user_sapstar : "1",
login/password_expiration_time : "90",
login/password_history_size : "1",
login/system_client : "208",
mpi/total_size_MB : "500",
ms/acl_info : "/usr/sap/C08/SYS/global/ms_acl_info",
nobuf/max_no_buffer_entries : "2000",
rdisp/PG_MAXFS : "491520",
rdisp/PG_SHM : "98304",
rdisp/ROLL_MAXFS : "163840",
rdisp/ROLL_SHM : "32768",
rdisp/accept_remote_trace_level : "0",
rdisp/appc_ca_blk_no : "3000",
rdisp/btcname : "stc08a00_C08_15",
rdisp/btctime : "20",
rdisp/bufrefmode : "sendon,exeauto",
rdisp/elem_per_queue : "4000",
rdisp/enqname : "stc08a00_C08_15",
rdisp/gui_auto_logout : "1800",
rdisp/max_arq : "2500",
rdisp/max_comm_entries : "2500",
rdisp/max_wprun_time : "1800",
rdisp/mshost : "stc08a00",
rdisp/msserv_internal : "3915",
rdisp/plugin_auto_logout : "900",
rdisp/rfc_check : "3",
rdisp/rfc_max_own_used_wp : "25",
rdisp/rfc_min_wait_dia_wp : "10",
rdisp/sna_gateway : "stc08a00",
rdisp/sna_gw_service : "sapgw15",
rdisp/tm_max_no : "2000",
rdisp/vbname : "stc08a00_C08_15",
rdisp/wp_ca_blk_no : "2000",
rdisp/wp_no_btc : "6",
rdisp/wp_no_dia : "30",
rdisp/wp_no_enq : "1",
rdisp/wp_no_spo : "1",
rdisp/wp_no_vb : "4",
rdisp/wp_no_vb2 : "4",
rsau/enable : "1",
rsau/selection_slots : "10",
rsdb/cua/buffersize : "240000",
rsdb/max_blocking_factor : "20",
rsdb/max_in_blocking_factor : "20",
rsdb/max_union_blocking_factor : "20",
rsdb/ntab/entrycount : "150000",
rsdb/ntab/ftabsize : "240000",
rsdb/ntab/irbdsize : "80000",
rsdb/ntab/sntabsize : "3500",
rsdb/obj/buffersize : "450000",
rsdb/obj/max_objects : "55000",
rsdb/prefer_fix_blocking : "1",
rsdb/ssfs_connect : "1",
rsec/ssfs_datapath : "$(DIR_GLOBAL)$(DIR_SEP)security$(DIR_SEP)rsecssfs$(DIR_SEP)data",
rsec/ssfs_keypath : "$(DIR_GLOBAL)$(DIR_SEP)security$(DIR_SEP)rsecssfs$(DIR_SEP)key",
rslg/max_diskspace/central : "5000000",
rslg/send_daemon/listen_port : "1215",
rslg/send_daemon/talk_port : "1315",
rspo/global_shm/printer_list : "4500",
rspo/spool_id/max_number : "200000",
rtbb/buffer_length : "80000",
rtbb/max_tables : "500",
sap/bufdir_entries : "10000",
sapgui/user_scripting : "TRUE",
sec/libsapsecu : "/sapmnt/C08/exe/libsapcrypto.so",
ssf/name : "SAPSECULIB",
ssf/ssfapi_lib : "/sapmnt/C08/exe/libsapcrypto.so",
ssl/ssl_lib : "/sapmnt/C08/exe/libsapcrypto.so",
system/type : "ABAP",
zcsa/calendar_area : "1020000",
zcsa/calendar_ids : "400",
zcsa/db_max_buftab : "80000",
zcsa/installed_languages : "123CDEFGHIKLNOPQRSTUVWXYa45689쁩",
zcsa/presentation_buffer_area : "70000000",
zcsa/system_language : "E",
zcsa/table_buffer_area : "1500000000",
ztta/dynpro_area : "900000",
ztta/parameter_area : "24000",
ztta/roll_extension : "2000000000"
}

[spyme72]

i think i have not posted my question clearly..
inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query
my second query is
index=equivalency sourcetype=json | spath | stats list() as | transpose
which would result all the fields in the JSON.
i want to pass the fields from the first query to the second query to filter the JSON data.

[spyme72]

i think i have not posted my question clearly..

inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query

my second query is
index=equivalency sourcetype=json | spath | stats list(*) as *| transpose
which would result all the fields in the JSON.

i want to pass the fields from the first query to the second query to filter the JSON data.

[somesoni2 · Accepted solution]

In if its still open, use following:

index=equivalency sourcetype=json | spath | stats list(*) as * | transpose

[somesoni2]

You can use following (assuming ,as per ur comment, first search give a column 'fields' which have values, name of fields, your want to display/use in second query)

inputlookup techtable| where technology= OS | fields fields|join fields[search index=equivalency sourcetype=json | spath | stats list() as *| transpose |rename column as fields]

This should give your output as 'fields'- contains only the fields present in your lookup, 'row 1' - values for those fields.

[spyme72]

i think i have not posted my question clearly..

inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query

my second query is
index=equivalency sourcetype=json | spath | stats list(*) as *| transpose
which would result all the fields in the JSON.

i want to pass the fields from the first query to the second query to filter the JSON data.