I have some data that looks similar to the following:
{
Name: Record1
Tags: [
{
Key: Tag1
Value: Value1
}
{
Key: Tag2
Value: Value2
}
{
Key: Tag3
Value: Value3
}
]
}
I am trying to create output table that looks like the following:
Name Tag1 Tag2 Tag3
-------------------------------
Record1 Value1 Value2 Value3
What have been trying to do so far is pathing into Tags and them combining them into one value, like so:
... | spath tags=Tags{} output=Tags | nomv Tags
This gives me one field with all the values that look like this:
{Key:Tag1,Value:Value1}{Key:Tag2,Value:Value2}{Key:Tag3,Value:Value3}
I'm thinking what I need to do next is a foreach statement to extract those values into an eval field, but can't quite seem to get it. Keep in mind I don't know what the Tags will be actually named, what their value will be, or how many there are for any given record.
Any suggestions would be appreciated. Or if there is an easier way to accomplish this, I am open to anything. 🙂
Thanks!
Try using transforms and extract keys and values into different groups.
Enable multi value for the transforms
[keyvaluepairs]
REGEX = \{\"key\"\:\"([^\"]+)\",\"value\"\:\"([^\"]+)
FORMAT=$1::$2
and use above transforms like below in search
search | extract keyvaluepairs