Getting Data In

How to display JSON map as a single multi-value field instead of multiple auto-discovered fields?

Path Finder

Hello,

I have an input module that injects data as _json source type.
In each event I have a field named "parameters" that contains a map (key-value entries) like this:

"parameters": {
   "parameter-a": "1",
   "parameter-b": "2",
   ...
}

I don't know the map keys, they may correlate between events but are not consistent.
Splunk automatically extracts them as "parameters.parameter-a" and "parameters.parameter-b" fields and this is not what I want.
It would rather have a multi-value field named "parameters" with each line containing both key and value like:

parameter-a=1
parameter-b=2

When I use:

| spath output=parameters path=parameters

I get a field that contains a raw JSON value of the "parameters" field (with brackets, quotes and commas).
When I use:

| spath output=parameters path=parameters{}

I get empty field values.
Is there a way to do what I want?

Thank you.

1 Solution

Builder

Hello @sbarinov,

please try this:

| makeresults 
| eval js="{\"parameters\": {\"parameter-a\": \"1\",\"parameter-b\": \"2\"}}"
| spath input=js path=parameters output=someOtherField
| spath input=someOtherField
| foreach parameter* [eval parameters=mvappend(parameters, '<<FIELD>>')]

View solution in original post

Builder

Hello @sbarinov,

please try this:

| makeresults 
| eval js="{\"parameters\": {\"parameter-a\": \"1\",\"parameter-b\": \"2\"}}"
| spath input=js path=parameters output=someOtherField
| spath input=someOtherField
| foreach parameter* [eval parameters=mvappend(parameters, '<<FIELD>>')]

View solution in original post

Explorer

How would you write the foreach statement if the parameters didn't share a name prefix like this: ?

| eval js="{\"parameters\": {\"wookie\": \"1\",\"jabba\": \"2\"}}" 

 

0 Karma

Path Finder

Thank you.

0 Karma

Builder

Welcome ! Any time.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!