Getting Data In

extract first value from json subarray

kannu
Communicator

Hello Guys ,

I have one json event in which there is subarray so i want to create one field which will have first index value of array for example

{
"data":
{"task":"pullFrom",
"from_repo":"https://abc.mxz.com:8089",
"to_repo":"https://abc.mxzz.com:8089",
"to_repo_change_count":20008,
"asset_uri":["kannu","search","ui-prefs","search"]
}
}

in above event i wnat to create the field which will have value only "kannu" from subarray "asset_uri" .

I tried doing data.asset_uri[0] as a normal json parsing but splunk is giving error while doing like this

Thanks in advance

0 Karma
1 Solution

javiergn
Super Champion

Hi @kannu,

Assuming your JSON is extracted correctly you could just do the following:

 | eval first_value = mvindex('data.asset_uri{}', 0)

Regards,
J

View solution in original post

0 Karma

to4kawa
Ultra Champion
...
| rex "(?ms)asset_uri\":\[\"(?<asset_uri>[^\"]+)"
0 Karma

javiergn
Super Champion

Hi @kannu,

Assuming your JSON is extracted correctly you could just do the following:

 | eval first_value = mvindex('data.asset_uri{}', 0)

Regards,
J

0 Karma

kannu
Communicator

This one is simple , i tried using the same but dont know why it doesnt work for me may be single quote i forget to add .

but thanks for helping me in resolving the issue

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval temp="{
\"data\":
{\"task\":\"pullFrom\",
\"from_repo\":\"https://abc.mxz.com:8089\",
\"to_repo\":\"https://abc.mxzz.com:8089\",
\"to_repo_change_count\":20008,
\"asset_uri\":[\"kannu\",\"search\",\"ui-prefs\",\"search\"]
}
}" 
| spath input=temp path=data.asset_uri{} output=asset_uri 
| eval asset_uri=mvindex(asset_uri,0)

kannu
Communicator

Thank you ravikumar

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...