- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![karthi25 karthi25](https://community.splunk.com/legacyfs/online/avatars/504313.jpg)
karthi25
Path Finder
02-26-2019
03:01 AM
I have a JSON with the following format:
{
"TestSplunkLog" : {
"TestFailureLog" : {
"appName" : "***",
"eventType" : "****",
"payload" : {
"level" : "ERROR",
"startTime" : "2019-02-06 06:20:13",
"failureCount" : 1000,
"errorCode" : 0,
"errorDescription" : "ERROR: column \"***\" is of type numeric but expression is of type character varying\n Hint: You will need to rewrite or cast the expression.\n Position: 860",
"failureIdList" : [ 2185745757, 2185745763, 2185745765, 2185960646, 2185960648, 2185960650, 2187284798, 2187345395, 2187345398, 2187353443 ],
"endTime" : "2019-02-06 06:20:24"
}
}
}
}
Now, I need to get all the failureidlist as a single comma separated string.
Can anyone please help me with some sample queries?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![vnravikumar vnravikumar](https://community.splunk.com/legacyfs/online/avatars/551099.jpg)
vnravikumar
Champion
02-26-2019
03:46 AM
Hi @karthi25
Try this and let me know
source="test1.json" host="dpds" sourcetype="_json"
| rename TestSplunkLog.TestFailureLog.payload.failureIdList{} as failureList
| eval new_failureList =mvjoin(failureList,",")
| table new_failureList
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![vnravikumar vnravikumar](https://community.splunk.com/legacyfs/online/avatars/551099.jpg)
vnravikumar
Champion
02-26-2019
03:46 AM
Hi @karthi25
Try this and let me know
source="test1.json" host="dpds" sourcetype="_json"
| rename TestSplunkLog.TestFailureLog.payload.failureIdList{} as failureList
| eval new_failureList =mvjoin(failureList,",")
| table new_failureList
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![karthi25 karthi25](https://community.splunk.com/legacyfs/online/avatars/504313.jpg)
karthi25
Path Finder
02-26-2019
03:51 AM
@vnravikumar Thanks..this worked for me.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MoniM
Communicator
02-26-2019
03:19 AM
Hi @karthi25 ,
What exactly you need in your output ? As the data is in jason format so the output will be in field-value i.e failureIdList" = 2185745757, 2185745763, 2185745765, 2185960646, 2185960648, 2185960650, 2187284798, 2187345395, 2187345398, 2187353443
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![karthi25 karthi25](https://community.splunk.com/legacyfs/online/avatars/504313.jpg)
karthi25
Path Finder
02-26-2019
03:45 AM
@MoniM I have tried this query
basesearch |spath path=TestSplunkLog.TestFailureLog.payload.failureIdList output=FAILURELIST| eval SNO=1 | accum SNO | table SNO,APPNAME,FAILURECOUNT,FAILURELIST,ERRORDESCRIPTION,STARTTIME,ENDTIME
All the records are populated correctly, but failurelist is not getting populated. In a table, at a single row I want like
1 | appname1 | 10 |2185745757, 2185745763, 2185745765, 2185960646, 2185960648, 2185960650, 2187284798, 2187345395, 2187345398, 2187353443 | INVALID RECORD | NULL | NULL
![](/skins/images/53C7C94B4DD15F7CACC6D77B9B4D55BF/responsive_peak/images/icon_anonymous_message.png)