Getting Data In

extract first value from json subarray

kannu
Communicator

Hello Guys ,

I have one json event in which there is subarray so i want to create one field which will have first index value of array for example

{
"data":
{"task":"pullFrom",
"from_repo":"https://abc.mxz.com:8089",
"to_repo":"https://abc.mxzz.com:8089",
"to_repo_change_count":20008,
"asset_uri":["kannu","search","ui-prefs","search"]
}
}

in above event i wnat to create the field which will have value only "kannu" from subarray "asset_uri" .

I tried doing data.asset_uri[0] as a normal json parsing but splunk is giving error while doing like this

Thanks in advance

0 Karma
1 Solution

javiergn
Super Champion

Hi @kannu,

Assuming your JSON is extracted correctly you could just do the following:

 | eval first_value = mvindex('data.asset_uri{}', 0)

Regards,
J

View solution in original post

0 Karma

to4kawa
Ultra Champion
...
| rex "(?ms)asset_uri\":\[\"(?<asset_uri>[^\"]+)"
0 Karma

javiergn
Super Champion

Hi @kannu,

Assuming your JSON is extracted correctly you could just do the following:

 | eval first_value = mvindex('data.asset_uri{}', 0)

Regards,
J

0 Karma

kannu
Communicator

This one is simple , i tried using the same but dont know why it doesnt work for me may be single quote i forget to add .

but thanks for helping me in resolving the issue

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval temp="{
\"data\":
{\"task\":\"pullFrom\",
\"from_repo\":\"https://abc.mxz.com:8089\",
\"to_repo\":\"https://abc.mxzz.com:8089\",
\"to_repo_change_count\":20008,
\"asset_uri\":[\"kannu\",\"search\",\"ui-prefs\",\"search\"]
}
}" 
| spath input=temp path=data.asset_uri{} output=asset_uri 
| eval asset_uri=mvindex(asset_uri,0)

kannu
Communicator

Thank you ravikumar

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...