Getting Data In

Split JSON object attributes out as key-value

johnoxley_liqui
Engager

I have a JSON object of currency conversion rates as the event, which looks like

{
  "base": "USD",
  "rates": {
    "GBP": 1.6,
    "ZAR": 10.2
  }
}

I want to pull the rates out as a table to look like

Currency      Rate
========      ====
GBP            1.6
ZAR           10.2

I can't figure out how to pull out the attribute as a column

Tags (1)

fervin
Path Finder

How's this look?

sourcetype=your_json | head 1
| spath output=gbp path=rates{}.GBP
| spath output=zar path=rates{}.ZAR
| table gbp, zar

0 Karma
Get Updates on the Splunk Community!

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...

Print, Leak, Repeat: UEBA Insider Threats You Can't Ignore

Are you ready to uncover the threats hiding in plain sight? Join us for "Print, Leak, Repeat: UEBA Insider ...

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...