How to display JSON map as a single multi-value field instead of multiple auto-discovered fields?

[sbarinov]

Hello,

I have an input module that injects data as _json source type.
In each event I have a field named "parameters" that contains a map (key-value entries) like this:

"parameters": {
   "parameter-a": "1",
   "parameter-b": "2",
   ...
}

I don't know the map keys, they may correlate between events but are not consistent.
Splunk automatically extracts them as "parameters.parameter-a" and "parameters.parameter-b" fields and this is not what I want.
It would rather have a multi-value field named "parameters" with each line containing both key and value like:

parameter-a=1
parameter-b=2

When I use:

| spath output=parameters path=parameters

I get a field that contains a raw JSON value of the "parameters" field (with brackets, quotes and commas).
When I use:

| spath output=parameters path=parameters{}

I get empty field values.
Is there a way to do what I want?

Thank you.

[poete · Accepted solution]

Hello @sbarinov,

please try this:

| makeresults 
| eval js="{\"parameters\": {\"parameter-a\": \"1\",\"parameter-b\": \"2\"}}"
| spath input=js path=parameters output=someOtherField
| spath input=someOtherField
| foreach parameter* [eval parameters=mvappend(parameters, '<<FIELD>>')]

[esalesap]

How would you write the foreach statement if the parameters didn't share a name prefix like this: ?

| eval js="{\"parameters\": {\"wookie\": \"1\",\"jabba\": \"2\"}}" 

[sbarinov]

Thank you.

[poete]

Welcome ! Any time.