Getting Data In

How to merge 2 json objects?

youngstrommj
Explorer

Hello, I have an existing json object and I'd like to merge another json object into it. I don't want to combine them into an array. I'd like them merged. Any ideas how I'd do this?

 

 

| eval object1=json_object("somekey","value")

 

 

 

 

| eval object2=json_object("someOtherKey","value")

 

 

Combined Value:

 

 

{"somekey":"value","someOtherKey":"value"}

 

 

 

 

Labels (1)
Tags (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@youngstrommj 

Can you please try this?

YOUR_SEARCH
| eval object2_keys = json_array_to_mv(json_keys(object2),false()) 
| eval object3=object1 
| foreach mode=multivalue object2_keys 
    [| eval object3=json_set(object3,<<ITEM>>,json_extract(object2,<<ITEM>>))
        ] 
| table object1 object2 object3

 

My Sample Search :

 

| makeresults 
| eval object1=json_object("somekey","value") 
| eval object2=json_object("someOtherKey","value","aaa","bbb") 
| eval object2_keys = json_array_to_mv(json_keys(object2),false()) 
| eval object3=object1 
| foreach mode=multivalue object2_keys 
    [| eval object3=json_set(object3,<<ITEM>>,json_extract(object2,<<ITEM>>))
        ] 
| table object1 object2 object3

 

Screenshot 2022-09-27 at 12.45.55 PM.png

I hope this will help you.

 

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...