Hi!
I have a JSON that looks like this (the repeting elements have been removed):
{
"data":{
"viewer":{
"homes":[
{
"currentSubscription":{
"status":"running",
"priceInfo":{
"range":{
"nodes":[
{
"total":0.5375,
"energy":0.43,
"tax":0.1075,
"startsAt":"2018-02-28T09:00:00+01:00",
"currency":"NOK"
},
{
"total":0.5371,
"energy":0.4297,
"tax":0.1074,
"startsAt":"2018-02-28T10:00:00+01:00",
"currency":"NOK"
},
{
"total":0.526,
"energy":0.4208,
"tax":0.1052,
"startsAt":"2018-02-28T11:00:00+01:00",
"currency":"NOK"
}
]
}
}
}
}
]
}
}
}
I'm really having problems getting this JSON parsed when the data comes into SPLUNK via REST.
I'm pulling the data once every day, so I want the "startsAt" to be the time for which I want to be the _time field. I want to have this done as a sourcetype.
In general, the data I want out of this JSON is like this:
_time total energy tax currency
event 2018-02-28T09:00:00+01:00 0.5375 0.43 0.1075 NOK
event 2018-02-28T10:00:00+01:00 0.5371 0.4297 0.1074 NOK
event 2018-02-28T11:00:00+01:00 0.526 0.4208 0.1052 NOK
@chrzz, following is a run anywhere search based on the sample data provided:
| makeresults
| eval _raw="{
\"data\":{
\"viewer\":{
\"homes\":[
{
\"currentSubscription\":{
\"status\":\"running\",
\"priceInfo\":{
\"range\":{
\"nodes\":[
{
\"total\":0.5375,
\"energy\":0.43,
\"tax\":0.1075,
\"startsAt\":\"2018-02-28T09:00:00+01:00\",
\"currency\":\"NOK\"
},
{
\"total\":0.5371,
\"energy\":0.4297,
\"tax\":0.1074,
\"startsAt\":\"2018-02-28T10:00:00+01:00\",
\"currency\":\"NOK\"
},
{
\"total\":0.526,
\"energy\":0.4208,
\"tax\":0.1052,
\"startsAt\":\"2018-02-28T11:00:00+01:00\",
\"currency\":\"NOK\"
}
]
}
}
}
}
]
}
}
}"
| spath
| rename data.viewer.homes{}.currentSubscription.priceInfo.range.nodes{}.* as *
| eval data=mvzip(startsAt,mvzip(energy,mvzip(tax,mvzip(total,currency))))
| fields - _*
| fields data
| mvexpand data
| makemv data delim=","
| eval _time=strptime(mvindex(data,0),"%Y-%m-%dT%H:%M:%S"), energy=mvindex(data,1), tax=mvindex(data,2), total=mvindex(data,3), currency=mvindex(data,4)
| fields - data
Thanks! But, this is only after the data have been indexed. I want this to be done at index-time in a sourcetype. How can I write the correct way to get the data into splunk the correct way?