Splunk Enterprise

Parse JSON only at 1st level

nagar57
Communicator

I want my nested JSON to be parsed only at 1st level instead of parsing all the nested parts. I have below JSON:

{ "Name":Naman, 
"Age":25, 
"Address": 
    { "H.No":"23", 
      "Street_no":2, 
      "Area":"Model Town" },
"Country":"IND" 
}

 I want output like below:

Name | Age  | Address             | Country 
Naman  25     "H.No":"23",           IND  
              "Street_no":2,
              "Area":"Model Town"

I don't want to handle Address field separately as these are dynamic fields that are coming in from source.

Tags (3)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

share _raw json otherwise regex may break.

————————————
If this helps, give a like below.
0 Karma

nagar57
Communicator

I can't paste the raw JSON as it contains company data. I hope you get the idea what I am trying to achieve. JSON is dynamic and I just want to parse at 1st level. All the nested fields should come as it is without getting parsed.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...