Getting Data In

How to merge 2 json objects?

youngstrommj
Explorer

Hello, I have an existing json object and I'd like to merge another json object into it. I don't want to combine them into an array. I'd like them merged. Any ideas how I'd do this?

 

 

| eval object1=json_object("somekey","value")

 

 

 

 

| eval object2=json_object("someOtherKey","value")

 

 

Combined Value:

 

 

{"somekey":"value","someOtherKey":"value"}

 

 

 

 

Labels (1)
Tags (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@youngstrommj 

Can you please try this?

YOUR_SEARCH
| eval object2_keys = json_array_to_mv(json_keys(object2),false()) 
| eval object3=object1 
| foreach mode=multivalue object2_keys 
    [| eval object3=json_set(object3,<<ITEM>>,json_extract(object2,<<ITEM>>))
        ] 
| table object1 object2 object3

 

My Sample Search :

 

| makeresults 
| eval object1=json_object("somekey","value") 
| eval object2=json_object("someOtherKey","value","aaa","bbb") 
| eval object2_keys = json_array_to_mv(json_keys(object2),false()) 
| eval object3=object1 
| foreach mode=multivalue object2_keys 
    [| eval object3=json_set(object3,<<ITEM>>,json_extract(object2,<<ITEM>>))
        ] 
| table object1 object2 object3

 

Screenshot 2022-09-27 at 12.45.55 PM.png

I hope this will help you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...