Splunk Search

Extract fields from array of data and find best performing currency.

sandeepmakkena
Contributor

SSP Request: {
"disableAMLFlag" = "false";
"orderAttributes" = {
"OrderAttributes" = {
"requestPostalIndicator" = "X";
"soldToParty" = "76";
"shipCompleteIndicator" = "false";
"disableLineLevelShipOptionsFlag" = "false";
"deliveryGroupingFlag" = "true";
"language" = "E";
"salesOrg" = "30";
"delayedPaymentFlag" = "false";
"locale" = "en-ca";
};
};
"addressArray" = (
{
"Address" = (
{
"cityName" = "Toronto";
"countryCode" = "CA";
"addressType" = "HomeHome";
"postalCode" = "00078";
"state" = "ON";
"addressID" = "b2e6d5-e488-431c-b20e-e5d1babb56cb";
}
);
}
);
"lineItemArray" = (
{
"LineItem" = (
{
"flag" = "false";
"itemNumber" = "c9b73e-ef52-44b0-b22e-83675318d2dc";
"quantity" = "1";
"bopisItem" = "STH";
"materialNumber" = "PTFP";
"selectedShipMethodCode" = "02";
"perUnitNetPrice" = "1699.00";
"currency" = "CAD";
"giftWrap" = {};
"commitCode" = "24";
"addressID" = "b2e6d5-e488-431c-b20e-e5d1babb56cb";
}
);
},
{
"LineItem" = (
{
"flag" = "false";
"itemNumber" = "4243ab-cc41-4ee8-abf9-fea5129dc624";
"quantity" = "1";
"bopisItem" = "STH";
"materialNumber" = "MWLE";
"selectedShipMethodCode" = "02";
"perUnitNetPrice" = "1049.00";
"currency" = "CAD";
"giftWrap" = {};
"commitCode" = "24";
"addressID" = "b2e6d5-e488-431c-b20e-e5d1babb56cb";
}
);
}
);
}

I have something like this I am trying to extract currency field, quantity and perUnitNetPrice to see best performning currency.

Thanks for your time in advance.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...