Getting Data In

How to merge 2 json objects?

youngstrommj
Explorer

Hello, I have an existing json object and I'd like to merge another json object into it. I don't want to combine them into an array. I'd like them merged. Any ideas how I'd do this?

 

 

| eval object1=json_object("somekey","value")

 

 

 

 

| eval object2=json_object("someOtherKey","value")

 

 

Combined Value:

 

 

{"somekey":"value","someOtherKey":"value"}

 

 

 

 

Labels (1)
Tags (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@youngstrommj 

Can you please try this?

YOUR_SEARCH
| eval object2_keys = json_array_to_mv(json_keys(object2),false()) 
| eval object3=object1 
| foreach mode=multivalue object2_keys 
    [| eval object3=json_set(object3,<<ITEM>>,json_extract(object2,<<ITEM>>))
        ] 
| table object1 object2 object3

 

My Sample Search :

 

| makeresults 
| eval object1=json_object("somekey","value") 
| eval object2=json_object("someOtherKey","value","aaa","bbb") 
| eval object2_keys = json_array_to_mv(json_keys(object2),false()) 
| eval object3=object1 
| foreach mode=multivalue object2_keys 
    [| eval object3=json_set(object3,<<ITEM>>,json_extract(object2,<<ITEM>>))
        ] 
| table object1 object2 object3

 

Screenshot 2022-09-27 at 12.45.55 PM.png

I hope this will help you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...