Getting Data In

Parsing out a 32-char GUID from a nested JSON array

New Member

I have a JSON object in Splunk that looks something like this:

  "myArr": [
    ... <more arrays> ...

What I'd like to do is:

  1. Pull out the nested array that has a first value of "redbull"
  2. Pull out the 2nd string from the nested array.
  3. Pull out the 2nd semicolon delimited item from that string.

In this particular example, what I want is:


Can anyone assist with this?

0 Karma


@nickchow, you can use spath to parse JSON data (
If you have enabled KV_MODE=json in props.conf for your data your JSON data should already be extracted without the spath command (

Following is a run anywhere search to mock up data as per question, you can add the command from | spath to your base search in your case:

|  makeresults
|  eval _raw="{
 |  spath
 |  rename "myArr{}" as "myArr"
 |  eval arr1=mvindex(myArr,0)
 |  eval arr2=mvindex(myArr,1)
 |  eval arr2=split(arr2,";")
 |  eval guid=mvindex(arr2,1)
 |  table _raw myArr arr1 arr2 guid
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!