Getting Data In

How do I extract fields from a JSON map while keeping the relationship?

atjohnso
New Member

Hi,

My stakeholders would like view events in the following JSON map log format, together in one record parsed out into separate fields:

  "cookie": [{
    "a": 1,
    "b": 1,
    "c": 1
  }, {
    "a": 2,
    "b": 2,
    "c": 2
  }, {
    "a": 3,
    "b": 3,
    "c": 3
  }]
} 

Desired report in Splunk :

a | b| c (header)
1 1 1
2 2 2
3 3 3

Is there a way to support this in Splunk?

If there is not an easy way, we can change the log structure. We wish to keep the information in JSON format, however (structuring log as a long string and regexing is not an option).

Thank you.

Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please try below search?

YOUR_SEARCH
| rename cookie{}.* as * 
| eval temp = mvzip(mvzip(c,b),c) 
| stats count by _time temp 
| eval a=mvindex(split(temp,","),0),b=mvindex(split(temp,","),1),c=mvindex(split(temp,","),2) 
| table a b c

My Sample Search:

| makeresults 
| eval _raw="{ \"cookie\": [{
\"a\": 1,
\"b\": 1,
\"c\": 1
}, {
\"a\": 2,
\"b\": 2,
\"c\": 2
}, {
\"a\": 3,
\"b\": 3,
\"c\": 3
}]
}" 
| kv 
| rename cookie{}.* as * 
| eval temp = mvzip(mvzip(c,b),c) 
| stats count by _time temp 
| eval a=mvindex(split(temp,","),0),b=mvindex(split(temp,","),1),c=mvindex(split(temp,","),2) 
| table a b c

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please try below search?

YOUR_SEARCH
| rename cookie{}.* as * 
| eval temp = mvzip(mvzip(c,b),c) 
| stats count by _time temp 
| eval a=mvindex(split(temp,","),0),b=mvindex(split(temp,","),1),c=mvindex(split(temp,","),2) 
| table a b c

My Sample Search:

| makeresults 
| eval _raw="{ \"cookie\": [{
\"a\": 1,
\"b\": 1,
\"c\": 1
}, {
\"a\": 2,
\"b\": 2,
\"c\": 2
}, {
\"a\": 3,
\"b\": 3,
\"c\": 3
}]
}" 
| kv 
| rename cookie{}.* as * 
| eval temp = mvzip(mvzip(c,b),c) 
| stats count by _time temp 
| eval a=mvindex(split(temp,","),0),b=mvindex(split(temp,","),1),c=mvindex(split(temp,","),2) 
| table a b c

Thanks

0 Karma

493669
Super Champion

try below in props.conf to extracts fields from JSON data.-

[<YourSourcetypeName>]
 KV_MODE=JSON
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...