Getting Data In

How to merge 2 json objects?

youngstrommj
Explorer

Hello, I have an existing json object and I'd like to merge another json object into it. I don't want to combine them into an array. I'd like them merged. Any ideas how I'd do this?

 

 

| eval object1=json_object("somekey","value")

 

 

 

 

| eval object2=json_object("someOtherKey","value")

 

 

Combined Value:

 

 

{"somekey":"value","someOtherKey":"value"}

 

 

 

 

Labels (1)
Tags (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@youngstrommj 

Can you please try this?

YOUR_SEARCH
| eval object2_keys = json_array_to_mv(json_keys(object2),false()) 
| eval object3=object1 
| foreach mode=multivalue object2_keys 
    [| eval object3=json_set(object3,<<ITEM>>,json_extract(object2,<<ITEM>>))
        ] 
| table object1 object2 object3

 

My Sample Search :

 

| makeresults 
| eval object1=json_object("somekey","value") 
| eval object2=json_object("someOtherKey","value","aaa","bbb") 
| eval object2_keys = json_array_to_mv(json_keys(object2),false()) 
| eval object3=object1 
| foreach mode=multivalue object2_keys 
    [| eval object3=json_set(object3,<<ITEM>>,json_extract(object2,<<ITEM>>))
        ] 
| table object1 object2 object3

 

Screenshot 2022-09-27 at 12.45.55 PM.png

I hope this will help you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

New This Month - Observability Updates Give Extended Visibility and Improve User ...

This month is a collection of special news! From Magic Quadrant updates to AppDynamics integrations to ...

Intro to Splunk Synthetic Monitoring

In our last post, we mentioned that the 3 key pieces of observability – metrics, logs, and traces – provide ...