How to populate Meaningful form of data

[Maniteja81]

Hi Guys,

Can you please help me, in framing a query.

Like i have this kind of data structure:
clk_ctrl: { [-]
GCC: { [-]
clock_name: [ [+]
]

lowsvs: fail

minsvs: fail

nom: 0

nom_l1: n/a

svs: fail

svs_l1: fail

turbo: 0

turbo_l1: 0

type: GCC

}

MCCC: { [-]
lowsvs: fail

minsvs: fail

nom: fail

nom_l1: n/a

svs: fail

svs_l1: fail

turbo: fail

turbo_l1: n/a

type: MCCC

}

dpcc: { [-]
lowsvs: fail

minsvs: fail

nom: fail

nom_l1: n/a

svs: fail

svs_l1: fail

turbo: fail

turbo_l1: fail

type: DPCC

}

}

func_area: source
groupID: project

site: sandiego

submit_timestamp: Tue Jul 30 09:35:11 2019

tool: qvmrs

unique_tag: vl-vpulipak-ice_17044

}

I want to print high level data like for GCC lowsvs, minsvs and this goes same for MCCC as well.

But if i do rename on the field names, it is taking the last renamed one. So i couldn't populate the rest.

Can you please help me in framing a query for this.

Thanks,
Maniteja

[jaime_ramirez]

Hi. Is it in JSON format? If it is you could try with spath command.

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Spath
https://answers.splunk.com/answers/401942/how-to-parse-my-json-data-with-spath-and-table-the.html