Splunk Search

How do you extract dynamic nested array coordinates from JSON?

aravindhan_padm
New Member

I need help in extracting fields from the dynamically nested array coordinates from JSON.

Here is the example data.

thirdParty: { [-]
Adobe Analytics: { [-]
bytes: 3182

end_time: 1726

requests: 4

serial_time: 212

start_time: 773

total_user_time: 953

}

Adobe TypeKit: { [-]
bytes: 162558
end_time: 895

requests: 4

serial_time: 38
start_time: 446

total_user_time: 449

}

Cloudfront: { [-]
bytes: 21578

end_time: 2241

requests: 1

serial_time: 26
start_time: 2215

total_user_time: 26
}

The number of arrays within the ThirdParty array is dynamic. And I need to create a table like this.

Site    total_user_time
Adobe Analytics 953
Adobe TypeKit   449
Cloudfront  26
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@aravindhan_padmanabhan

Can you please try below search?

YOUR_SEARCH | spath thirdParty output=_raw | kv | fields *.total_user_time, | fields - thirdParty.* _raw, _time | rename *.total_user_time as * | transpose column_name=Site | rename "row 1" as total_user_time

My Sample Search:

| makeresults | eval _raw="{\"thirdParty\": {\"Adobe Analytics\": {\"bytes\": \"3182\",\"end_time\": \"1726\",\"requests\": \"4\",\"serial_time\": \"212\",\"start_time\": \"773\",\"total_user_time\": \"953\"},\"Adobe TypeKit\": {\"bytes\": \"162558\",\"end_time\": \"895\",\"requests\": \"4\",\"serial_time\": \"38\",\"start_time\": \"446\",\"total_user_time\": \"449\"},\"Cloudfront\": {\"bytes\": \"21578\",\"end_time\": \"2241\",\"requests\": \"1\",\"serial_time\": \"26\",\"start_time\": \"2215\",\"total_user_time\": \"26\"}}}" | kv | spath thirdParty output=_raw | kv | fields *.total_user_time, | fields - thirdParty.* _raw, _time
| rename *.total_user_time as * | transpose column_name=Site | rename "row 1" as total_user_time

Thanks

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...