Getting Data In

extract first value from json subarray

kannu
Communicator

Hello Guys ,

I have one json event in which there is subarray so i want to create one field which will have first index value of array for example

{
"data":
{"task":"pullFrom",
"from_repo":"https://abc.mxz.com:8089",
"to_repo":"https://abc.mxzz.com:8089",
"to_repo_change_count":20008,
"asset_uri":["kannu","search","ui-prefs","search"]
}
}

in above event i wnat to create the field which will have value only "kannu" from subarray "asset_uri" .

I tried doing data.asset_uri[0] as a normal json parsing but splunk is giving error while doing like this

Thanks in advance

0 Karma
1 Solution

javiergn
Super Champion

Hi @kannu,

Assuming your JSON is extracted correctly you could just do the following:

 | eval first_value = mvindex('data.asset_uri{}', 0)

Regards,
J

View solution in original post

0 Karma

to4kawa
Ultra Champion
...
| rex "(?ms)asset_uri\":\[\"(?<asset_uri>[^\"]+)"
0 Karma

javiergn
Super Champion

Hi @kannu,

Assuming your JSON is extracted correctly you could just do the following:

 | eval first_value = mvindex('data.asset_uri{}', 0)

Regards,
J

0 Karma

kannu
Communicator

This one is simple , i tried using the same but dont know why it doesnt work for me may be single quote i forget to add .

but thanks for helping me in resolving the issue

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval temp="{
\"data\":
{\"task\":\"pullFrom\",
\"from_repo\":\"https://abc.mxz.com:8089\",
\"to_repo\":\"https://abc.mxzz.com:8089\",
\"to_repo_change_count\":20008,
\"asset_uri\":[\"kannu\",\"search\",\"ui-prefs\",\"search\"]
}
}" 
| spath input=temp path=data.asset_uri{} output=asset_uri 
| eval asset_uri=mvindex(asset_uri,0)

kannu
Communicator

Thank you ravikumar

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...