I have a JSON object in Splunk that looks something like this:
{
"myArr": [
[
"redbull",
"2;2cf77a02b5f047bbb1ae4522d9e614a6;OpAJa;1YdsW;3Z;zs"
],
... <more arrays> ...
]
}
What I'd like to do is:
In this particular example, what I want is:
2cf77a02b5f047bbb1ae4522d9e614a6
Can anyone assist with this?
@nickchow, you can use spath to parse JSON data (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath)
If you have enabled KV_MODE=json
in props.conf
for your data your JSON data should already be extracted without the spath command (https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Field_extraction_configuration).
Following is a run anywhere search to mock up data as per question, you can add the command from | spath
to your base search in your case:
| makeresults
| eval _raw="{
\"myArr\":
[
\"redbull\",
\"2;2cf77a02b5f047bbb1ae4522d9e614a6;OpAJa;1YdsW;3Z;zs\"
]
}"
| spath
| rename "myArr{}" as "myArr"
| eval arr1=mvindex(myArr,0)
| eval arr2=mvindex(myArr,1)
| eval arr2=split(arr2,";")
| eval guid=mvindex(arr2,1)
| table _raw myArr arr1 arr2 guid