Getting Data In

How to parse json array and rename the values?

mkamal18
New Member

Hello,

I would like to parse the array called values that contains 45 and 0
I want to rename them then 45 as name and 0 as value

{ [-]
dsnames: [ [+]
]

dstypes: [ [+]
]

host: test

interval: 60
plugin: snmp

plugin_instance:

time: 1510070934.341
type: ps_count

type_instance: fval3-cp-23800-1_vs30

values: [ [-]
45
0

]

}

Can you help me please?

Thank you in advance

0 Karma
1 Solution

niketn
Legend

@mkamal18, please try the following run anywhere search. Since you are not worried about dsnames and dstypes JSON nodes, I have taken them out while creating test data as per sample provided. This implies actual JSON field name for values, on using spath command will change from the one used in this example.

|  makeresults
|  eval _raw="{
    \"host\": \"test\", 
    \"interval\": 60 ,
    \"plugin\": \"snmp\", 
    \"plugin_instance\": {
        \"time\": \"1510070934.341\", 
        \"type\": \"ps_count\", 
        \"type_instance\": \"fval3-cp-23800-1_vs30\", 
        \"values\": [45,0]}}"
|  spath
|  rename "plugin_instance.values{}" AS "values"
|  eval name=mvindex(values,0)
|  eval value=mvindex(values,1)

You can pipe spath command to your raw data to get JSON fields extracted. You will notice the *values{} field will be multi-valued array. You would need to rename according to its name to simplified name such as values. Finally use the mvindex() evaluation function to pull values at 0 and 1 index.

<YourBaseSearch>
| spath
|  rename "plugin_instance.values{}" AS "values"
|  eval name=mvindex(values,0)
|  eval value=mvindex(values,1)

PS: Please change the rename command as per actual original field name for *values{}

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@mkamal18, please try the following run anywhere search. Since you are not worried about dsnames and dstypes JSON nodes, I have taken them out while creating test data as per sample provided. This implies actual JSON field name for values, on using spath command will change from the one used in this example.

|  makeresults
|  eval _raw="{
    \"host\": \"test\", 
    \"interval\": 60 ,
    \"plugin\": \"snmp\", 
    \"plugin_instance\": {
        \"time\": \"1510070934.341\", 
        \"type\": \"ps_count\", 
        \"type_instance\": \"fval3-cp-23800-1_vs30\", 
        \"values\": [45,0]}}"
|  spath
|  rename "plugin_instance.values{}" AS "values"
|  eval name=mvindex(values,0)
|  eval value=mvindex(values,1)

You can pipe spath command to your raw data to get JSON fields extracted. You will notice the *values{} field will be multi-valued array. You would need to rename according to its name to simplified name such as values. Finally use the mvindex() evaluation function to pull values at 0 and 1 index.

<YourBaseSearch>
| spath
|  rename "plugin_instance.values{}" AS "values"
|  eval name=mvindex(values,0)
|  eval value=mvindex(values,1)

PS: Please change the rename command as per actual original field name for *values{}

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

mkamal18
New Member

Perfect it works, Thanks man!! 🙂

0 Karma

niketn
Legend

Anytime! Do think of us in case you need further help with your Splunk queries 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @mkamal18,

Use values{} to access values field.

Please check my sample search.

| makeresults 
| eval _raw="{\"values\": [\"45\",\"0\"] }" 
| spath  
| rename values{} as values

Happy Splunking

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...