Getting Data In

Json extraction with optional embedded element

psable
Explorer

HI,
I am tryig to get elements extracted from array which looks like this :
{
"Version": 2,
"diagnostic": [
{
"name": "EMERGENCY_FUND",
"stringValue": " 6 months",
"isCohortUsed": true,
"cohortDefaultCode": "EX"
},
{
"name": "RATE",
"doubleValue": 0,
"isCohortUsed": true,
"cohortDefaultCode": "WR"
},
{
"name": "CHANCE",
"score": {
"scorevalue": 10,
"valueType": "PERCENT"
},
"stringValue": "likely",
"isCohortUsed": true,
"cohortDefaultCode": "CW"
}
}

Of alll this array, I want to extract element array score and its value for that respective Name i.e.

Name scorevalue
CHANCE 10

The score element may or may not be present in parent array element.

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

| rex field=_raw mode=sed "s/\"(doubleValue)\"/\"stringValue\"/g"
| rex field=_raw mode=sed "s/\"score\": {[\r\n\s]*\"scorevalue\": (\d*),[\r\n\s]*\"valueType\": \"(\w*)\"[\r\n\s]*},[\r\n\s]*\"stringValue\": \"(\w*)\",/\"stringValue\": \"\3 \1 \2\"/g"
| spath
| rename diagnostic{}.* AS *
| eval nameValue=mvzip(name,stringValue, "=")
| mvexpand nameValue | fields - name stringValue

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| rex field=_raw mode=sed "s/\"(doubleValue)\"/\"stringValue\"/g"
| rex field=_raw mode=sed "s/\"score\": {[\r\n\s]*\"scorevalue\": (\d*),[\r\n\s]*\"valueType\": \"(\w*)\"[\r\n\s]*},[\r\n\s]*\"stringValue\": \"(\w*)\",/\"stringValue\": \"\3 \1 \2\"/g"
| spath
| rename diagnostic{}.* AS *
| eval nameValue=mvzip(name,stringValue, "=")
| mvexpand nameValue | fields - name stringValue
0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...