Extract nested json

[ch1221]

Looking for some assistance extracting all of the nested json values like the "results", "tags" and "iocs" in the screenshot. I've been trying to get spath and mvexpand to work for days but apparently I am not doing something right. Any help is appreciated.

[to4kawa · Accepted solution]

your search
| rex "results\":\s(?<results>\[.*\])"
| spath
| fields - _* results{}.* 
| stats values(*) as * by results
| spath input=results {} output=results
| stats values(*) as * by results
| spath input=results
| fields - results
| eval tags=mvjoin('tags{}',",")
| fields - tags{} source sourcetype splunk_server punct date_* host

Thanks for your sample. how about this?

[ch1221]

That doesn't work. It returns 6 events (based on the tags it appears) with all of the other values identical.

[ch1221]

The raw results that I provided was a sample of 103+ results which is too much to post.

[to4kawa]

Put it up on another site temporarily and let me know the link.

[ch1221]

https://www.dropbox.com/s/hjs4ez36y8g622q/cbfeeds.txt?dl=0

[to4kawa]

I see, my answer is updated.

[ch1221]

Fantastic! Thank you so much!!!!!

[Sfry1981]

if you run the search and then table it does it show as being parsed into its own columns as that might give you what you need.

Otherwise you may need to regex the data first if spath or mvexpand could not be used.

Also can you provide the output what is happening after you try with your search so we can try and work out a solution?

[to4kawa]

click Show as raw text in events

[ch1221]

{ "start": 0, "terms": [ "feed_id:14" ], "highlights": [], "total_results": 103, "filtered": {}, "facets": {}, "results": [ { "ipv4_count": 0, "description": "description of event", "tags": [ "threathunting", "hunting", "t1033", "discovery", "recon", "windows" ], "feed_id": 14, "timestamp": 1552664393, "feed_category": "xxx", "sha256_count": 0, "create_time": 1552664393, "link": "hxxps://xxx.xxx", "id": "565616", "query_count": 1, "is_deleted": false, "title": "test", "has_query": true, "iocs": { "query": [ { "index_type": "events", "search_query": "test query" } ] }, "is_ignored": false, "feed_name": "test feed", "md5_count": 0, "score": 65, "ipv6_count": 0, "domain_count": 0 }, ], "elapsed": 0.013309955596923828}

[to4kawa]

your JSON can't be extracted using spath and mvexpand

This Only can be extracted from _raw, not Show syntax highlighted