Splunk Search

How do I change field names (extracted field name) to field values?

vasugazula
New Member

I have a json structure that contains an object map:

{
  "correlation_id": "f9535d13-f75b-4dd7-8c39-1e77b1559afe",
  "targeting_data": [
    {
      "attribute_values": {
        "1013": "005",
        "2056": "07",
        "2057": "01",
        "2058": "03",
        "2060": "02",
        "2065": "01",
        "2075": "04",
        "2080": "03",
        "2081": "01",
        "DMA": "803",
        "RECTYPE": "HD",
        "RECVCNT": "6",
        "STATE": "CA",
        "SVCPKGTIER": "5"
      },
      "origin": null
    }
  ],
  "timestamp": "2020-06-02T00:02:09.257+00:00",
  "zone_target_area": "195"
}

How do i take the fields extracted as targeting_data{}.attribute_values.1013, targeting_data{}.attribute_values.2056 and output the field names (1013, 2056) as values. I would like for my output to be a list of the map's keys.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vasugazula

Can you please try this? You will have your values in map_s_keys field.

YOUR_SEARCH | eval map_s_keys="" 
| foreach targeting_data{}.attribute_values.*  [ eval map_s_keys=if(map_s_keys="","<<MATCHSTR>>",  map_s_keys.","."<<MATCHSTR>>") ] | table map_s_keys

Sample Search:

| makeresults | eval _raw="{\"correlation_id\": \"f9535d13-f75b-4dd7-8c39-1e77b1559afe\",\"targeting_data\": [{\"attribute_values\": {\"1013\": \"005\",\"2056\": \"07\",\"2057\": \"01\",\"2058\": \"03\",\"2060\": \"02\",\"2065\": \"01\",\"2075\": \"04\",\"2080\": \"03\",\"2081\": \"01\",\"DMA\": \"803\",\"RECTYPE\": \"HD\",\"RECVCNT\": \"6\",\"STATE\": \"CA\",\"SVCPKGTIER\": \"5\"},\"origin\": null}],\"timestamp\": \"2020-06-02T00:02:09.257+00:00\",\"zone_target_area\": \"195\"}" | extract | eval map_s_keys="" 
| foreach targeting_data{}.attribute_values.*  [ eval map_s_keys=if(map_s_keys="","<<MATCHSTR>>",  map_s_keys.","."<<MATCHSTR>>") ] | table map_s_keys

Thanks

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...