JSON format in splunk

[wellsajs]

I have installed the RESTFUL TA APP in Splunk and have a data set being sucked into Splunk.
The only challenge I am having now is the JSON seems to be getting parsed and interpreted correctly, however I am not able to associate the fields to one another as they are all segregated to some extent.

Below is a sample data set and my end goal is to be able to associate a device.name to a value like result{}..ping_rtt.total as an example, however I am not seeing how this is possible in an easy way.

Any help would be much appreciated.

DATA SET

{"meta":{"epoch":1450820945,"hash":null,"message":"ok","query":"range=1450820940 - 6m TO 1450820940 - 1m","range":[1450820580,1450820880],"result_count":50,"result_offset":0,"result_total":275,"time":"Wed Dec 23 07:49:05 2015","tz":"Australia/Brisbane","tz_offset":36000},"result":[{".ping_rtt":{"avg":0,"count":6,"max":0,"min":0,"total":0,"vals":[0,0,0,0,0,0]},"device.name":"bffg-vm-server","id":151},{".ping_rtt":{"avg":0,"count":6,"max":0,"min":0,"total":0,"vals":[0,0,0,0,0,0]},"device.name":"ddf-vm-server","id":152},{".ping_rtt":{"avg":0,"count":6,"max":0,"min":0,"total":0,"vals":[0,0,0,0,0,0]},"device.name":"abb-vm-server","id":153},{".ping_rtt":null,"device.name":"test122","id":154},{".ping_rtt":{"avg":27.83333333333333,"count":6,"max":32,"min":22,"total":167,"vals":[27,28,32,27,22,31]},"device.name":"SanJose-core","id":214},{".ping_rtt":{"avg":25.33333333333333,"count":6,"max":31,"min":17,"total":152,"vals":[27,23,27,27,17,31]},"device.name":"NewYork-ups1","id":215},{".ping_rtt":{"avg":37.83333333333334,"count":6,"max":47,"min":32,"total":227,"vals":[37,33,47,37,32,41]},"device.name":"NewYork-ups2","id":216},{".ping_rtt":{"avg":35.33333333333334,"count":6,"max":37,"min":32,"total":212,"vals":[37,33,37,37,32,36]},"device.name":"NewYork-srv1","id":217},{".ping_rtt":{"avg":17.83333333333333,"count":6,"max":26,"min":11,"total":107,"vals":[16,13,19,22,11,26]},"device.name":"NewYork-srv2","id":218},{".ping_rtt":{"avg":58.33333333333334,"count":6,"max":62,"min":53,"total":350,"vals":[57,53,59,62,58,61]},"device.name":"NewYork-srv3","id":219},{".ping_rtt":{"avg":41.16666666666666,"count":6,"max":62,"min":16,"total":247,"vals":[62,48,37,32,16,52]},"device.name":"NewYork-srv4","id":220},{".ping_rtt":{"avg":34.83333333333334,"count":6,"max":39,"min":31,"total":209,"vals":[37,33,39,37,32,31]},"device.name":"NewYork-fw1","id":221},{".ping_rtt":{"avg":35.33333333333334,"count":6,"max":37,"min":32,"total":212,"vals":[37,33,37,37,32,36]},"device.name":"NewYork-fw2","id":222},{".ping_rtt":{"avg":28.33333333333333,"count":6,"max":37,"min":21,"total":170,"vals":[37,28,32,27,25,21]},"device.name":"NewYork-swt4","id":223},{".ping_rtt":{"avg":16.83333333333333,"count":6,"max":21,"min":10,"total":101,"vals":[16,18,19,17,10,21]},"device.name":"NewYork-swt3","id":224},{".ping_rtt":{"avg":47.33333333333334,"count":6,"max":53,"min":41,"total":284,"vals":[47,50,53,51,42,41]},"device.name":"NewYork-swt2","id":225},{".ping_rtt":{"avg":20.66666666666667,"count":6,"max":27,"min":16,"total":124,"vals":[21,18,24,18,27,16]},"device.name":"NewYork-swt1","id":226},{".ping_rtt":{"avg":20.66666666666667,"count":6,"max":25,"min":17,"total":124,"vals":[21,18,22,17,25,21]},"device.name":"NewYork-rtr","id":227},{".ping_rtt":{"avg":35.83333333333334,"count":6,"max":37,"min":33,"total":215,"vals":[37,33,37,36,37,35]},"device.name":"LosAngeles-ups1","id":228},{".ping_rtt":{"avg":null,"count":0,"max":null,"min":null,"total":null,"vals":[null,null,null,null,null,null]},"device.name":"LosAngeles-ups2","id":229},{".ping_rtt":{"avg":17.66666666666667,"count":6,"max":24,"min":15,"total":106,"vals":[16,18,24,17,15,16]},"device.name":"LosAngeles-srv1","id":230},{".ping_rtt":{"avg":32.5,"count":6,"max":40,"min":21,"total":195,"vals":[21,33,38,26,37,40]},"device.name":"LosAngeles-srv2","id":231},{".ping_rtt":{"avg":36.16666666666666,"count":6,"max":43,"min":31,"total":217,"vals":[31,33,43,36,32,42]},"device.name":"LosAngeles-srv3","id":232},{".ping_rtt":{"avg":49.66666666666666,"count":6,"max":56,"min":45,"total":298,"vals":[46,45,53,56,47,51]},"device.name":"LosAngeles-srv4","id":233},{".ping_rtt":{"avg":36.5,"count":6,"max":38,"min":35,"total":219,"vals":[36,38,37,36,37,35]},"device.name":"LosAngeles-fw","id":234},{".ping_rtt":{"avg":55.83333333333334,"count":6,"max":62,"min":48,"total":335,"vals":[56,48,62,56,52,61]},"device.name":"LosAngeles-swt4","id":235},{".ping_rtt":{"avg":36.5,"count":6,"max":38,"min":35,"total":219,"vals":[36,38,37,36,37,35]},"device.name":"LosAngeles-swt3","id":236},{".ping_rtt":{"avg":16.16666666666667,"count":6,"max":18,"min":15,"total":97,"vals":[16,17,18,16,15,15]},"device.name":"LosAngeles-swt2","id":237},{".ping_rtt":{"avg":16.33333333333333,"count":6,"max":18,"min":15,"total":98,"vals":[16,18,18,16,15,15]},"device.name":"LosAngeles-swt1","id":238},{".ping_rtt":{"avg":40.83333333333334,"count":6,"max":47,"min":35,"total":245,"vals":[41,45,41,36,47,35]},"device.name":"LosAngeles-rtr","id":239},{".ping_rtt":{"avg":33.16666666666666,"count":6,"max":37,"min":21,"total":199,"vals":[21,33,37,36,37,35]},"device.name":"Chicago-ups1","id":240},{".ping_rtt":{"avg":36.5,"count":6,"max":38,"min":35,"total":219,"vals":[36,38,37,36,37,35]},"device.name":"Chicago-ups2","id":241},{".ping_rtt":{"avg":20.83333333333333,"count":6,"max":26,"min":15,"total":125,"vals":[26,23,18,21,22,15]},"device.name":"Chicago-srv1","id":242},{".ping_rtt":{"avg":50.33333333333334,"count":6,"max":55,"min":46,"total":302,"vals":[46,55,48,55,52,46]},"device.name":"Chicago-srv2","id":243},{".ping_rtt":{"avg":null,"count":0,"max":null,"min":null,"total":null,"vals":[null,null,null,null,null,null]},"device.name":"Chicago-fw","id":244},{".ping_rtt":{"avg":45,"count":6,"max":52,"min":41,"total":270,"vals":[41,43,48,41,52,45]},"device.name":"Chicago-swt4","id":245},{".ping_rtt":{"avg":16.16666666666667,"count":6,"max":18,"min":15,"total":97,"vals":[16,17,18,16,15,15]},"device.name":"Chicago-swt3","id":246},{".ping_rtt":{"avg":35.33333333333334,"count":6,"max":37,"min":32,"total":212,"vals":[36,32,36,36,37,35]},"device.name":"Chicago-swt1","id":247},{".ping_rtt":{"avg":35.33333333333334,"count":6,"max":39,"min":31,"total":212,"vals":[36,39,34,35,31,37]},"device.name":"Chicago-rtr","id":248},{".ping_rtt":{"avg":18.83333333333333,"count":6,"max":24,"min":12,"total":113,"vals":[12,24,24,15,16,22]},"device.name":"Houston-ups1","id":249},{".ping_rtt":{"avg":37.66666666666666,"count":6,"max":52,"min":31,"total":226,"vals":[31,34,52,46,31,32]},"device.name":"Houston-ups2","id":250},{".ping_rtt":{"avg":31.5,"count":6,"max":37,"min":26,"total":189,"vals":[36,29,31,30,26,37]},"device.name":"Houston-srv1","id":251},{".ping_rtt":{"avg":null,"count":0,"max":null,"min":null,"total":null,"vals":[null,null,null,null,null,null]},"device.name":"Houston-srv2","id":252},{".ping_rtt":{"avg":null,"count":0,"max":null,"min":null,"total":null,"vals":[null,null,null,null,null,null]},"device.name":"Houston-fw","id":253},{".ping_rtt":{"avg":50.16666666666666,"count":6,"max":60,"min":39,"total":301,"vals":[60,44,39,50,56,52]},"device.name":"Houston-swt4","id":254},{".ping_rtt":{"avg":23.5,"count":6,"max":35,"min":17,"total":141,"vals":[35,19,24,20,26,17]},"device.name":"Houston-swt3","id":255},{".ping_rtt":{"avg":37.33333333333334,"count":6,"max":40,"min":35,"total":224,"vals":[40,38,38,35,36,37]},"device.name":"Houston-swt2","id":256},{".ping_rtt":{"avg":55,"count":6,"max":71,"min":35,"total":330,"vals":[65,53,44,35,71,62]},"device.name":"Houston-swt1","id":257},{".ping_rtt":{"avg":22.33333333333333,"count":6,"max":29,"min":15,"total":134,"vals":[19,29,24,15,20,27]},"device.name":"Houston-rtr","id":258},{".ping_rtt":{"avg":17.33333333333333,"count":6,"max":19,"min":15,"total":104,"vals":[19,18,19,15,16,17]},"device.name":"Phoenix-ups1","id":259}],"success":true}

Thanks for your help

[sundareshr]

Try something like this. This assumes a 1:1 relationship between "name" & "value". If a specific "value" has multiple values, you may be able to use the mv commands on that individual field.

| spath | rename <path for name> as name | rename <path for value> as value | eval combined=mvzip(name, value, "@@") | mvexpand combined | eval comb_split=split(combined, "@@") | eval name=mvindex(comb_split, 0) | value=mvindex(comb_split, 1) 

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/spath

http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Parsemultivaluefields

[Raghav2384]

In case you haven't, please take a look at this https://answers.splunk.com/answers/148307/how-to-parse-and-extract-json-log-files-in-splunk.html