How to parse json array and rename the values?

[mkamal18]

Hello,

I would like to parse the array called values that contains 45 and 0
I want to rename them then 45 as name and 0 as value

{ [-]
dsnames: [ [+]
]

dstypes: [ [+]
]

host: test

interval: 60
plugin: snmp

plugin_instance:

time: 1510070934.341
type: ps_count

type_instance: fval3-cp-23800-1_vs30

values: [ [-]
45
0

]
}

Can you help me please?

Thank you in advance

[niketn · Accepted solution]

@mkamal18, please try the following run anywhere search. Since you are not worried about dsnames and dstypes JSON nodes, I have taken them out while creating test data as per sample provided. This implies actual JSON field name for values, on using spath command will change from the one used in this example.

|  makeresults
|  eval _raw="{
    \"host\": \"test\", 
    \"interval\": 60 ,
    \"plugin\": \"snmp\", 
    \"plugin_instance\": {
        \"time\": \"1510070934.341\", 
        \"type\": \"ps_count\", 
        \"type_instance\": \"fval3-cp-23800-1_vs30\", 
        \"values\": [45,0]}}"
|  spath
|  rename "plugin_instance.values{}" AS "values"
|  eval name=mvindex(values,0)
|  eval value=mvindex(values,1)

You can pipe spath command to your raw data to get JSON fields extracted. You will notice the *values{} field will be multi-valued array. You would need to rename according to its name to simplified name such as values. Finally use the mvindex() evaluation function to pull values at 0 and 1 index.

<YourBaseSearch>
| spath
|  rename "plugin_instance.values{}" AS "values"
|  eval name=mvindex(values,0)
|  eval value=mvindex(values,1)

PS: Please change the rename command as per actual original field name for *values{}

[mkamal18]

Perfect it works, Thanks man!! 🙂

[niketn]

Anytime! Do think of us in case you need further help with your Splunk queries 🙂

[kamlesh_vaghela]

Hi @mkamal18,

Use values{} to access values field.

Please check my sample search.

| makeresults 
| eval _raw="{\"values\": [\"45\",\"0\"] }" 
| spath  
| rename values{} as values

Happy Splunking