Getting Data In

How to extract the nested array coordinates from JSON?

weiquanswq
Explorer

Hi !!
I am new to Splunk and trying to extract the array coordinates from Json.

{"type":"Feature","geometry":{"type":"MultiPoint","coordinates":[[103.62107,1.27478],[103.622,1.29625],  ……., [103.6224,1.28207]]}}

Is anyone able to help me out here?

Thanks

0 Karma
1 Solution

weiquanswq
Explorer

I able to achieve the results I want using spath and extract according to the index.

My code is as follows:
... | spath path=features{}.geometry.coordinates{}{0} output=a
| spath path=features{}.geometry.coordinates{}{1} output=b
| table a b | eval x=mvzip(a,b)| mvexpand x

Hope this will be useful. 🙂

View solution in original post

0 Karma

weiquanswq
Explorer

I able to achieve the results I want using spath and extract according to the index.

My code is as follows:
... | spath path=features{}.geometry.coordinates{}{0} output=a
| spath path=features{}.geometry.coordinates{}{1} output=b
| table a b | eval x=mvzip(a,b)| mvexpand x

Hope this will be useful. 🙂

0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

Try this in your props.conf:
under the sourcetype or monitor stanza:

Example:

[myjson_sourcetype]
EXTRACT-coordinates = `\[\[(?P<coord_1>\S+)],\[(?P<coord_2>\S+)\].+\[(?P<coord_3>\S+)\]\]`

The above will create the 3 fields (coord_1, 2 and 3. Assuming the data comes in like that, you should be good to go. If not, please post more of the data, so we can all take a look.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...