Splunk Search

Extract value from JSON array of objects

AlexMcDuffMille
Communicator

I have a JSON object that has an array inside of it. The array is a list of objects, not just a list of values. See below for an example.

I want to extract the 'duration' field for each event when the name is 'responseTime'. Does anyone know how to do that? I can also assume that it's always going to be the 2nd entry in the list, so if I could do something like Timings[1] that would work. I can't seem to get spath to work because I'm looking for an item within an array.

In the end, I would like to do something like graph/table the duration of the 'providerTime' and the 'responseTime'

{
    Timings: [ 
      { 
         duration:  218 
         name:  providerTime
      } 
      { 
         duration:  204 
         name:  responseTime
      } 
    ] 
 }

somesoni2
Revered Legend

My answer will assume following
1) The data is ingested as proper JSON and you should be seeing multivalued field for your array elements (KV_MODE = json)
2) As you said, responseTime is the 2nd element in and it appears only one.

So try something like this

your base search  | table Timings{}.* | eval temp=mvzip('Timings{}.duration','Timings{}.name',"##") | eval ResponseTime=mvindex(split(mvfilter(match(temp,".*##responseTime")),"##"),0)
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...