How do you extract dynamic nested array coordinates from JSON?

[aravindhan_padm]

I need help in extracting fields from the dynamically nested array coordinates from JSON.

Here is the example data.

thirdParty: { [-]
Adobe Analytics: { [-]
bytes: 3182

end_time: 1726

requests: 4

serial_time: 212

start_time: 773

total_user_time: 953

}

Adobe TypeKit: { [-]
bytes: 162558
end_time: 895

requests: 4

serial_time: 38
start_time: 446

total_user_time: 449

}

Cloudfront: { [-]
bytes: 21578

end_time: 2241

requests: 1

serial_time: 26
start_time: 2215

total_user_time: 26
}

The number of arrays within the ThirdParty array is dynamic. And I need to create a table like this.

Site    total_user_time
Adobe Analytics 953
Adobe TypeKit   449
Cloudfront  26

[kamlesh_vaghela]

@aravindhan_padmanabhan

Can you please try below search?

YOUR_SEARCH | spath thirdParty output=_raw | kv | fields *.total_user_time, | fields - thirdParty.* _raw, _time | rename *.total_user_time as * | transpose column_name=Site | rename "row 1" as total_user_time

My Sample Search:

| makeresults | eval _raw="{\"thirdParty\": {\"Adobe Analytics\": {\"bytes\": \"3182\",\"end_time\": \"1726\",\"requests\": \"4\",\"serial_time\": \"212\",\"start_time\": \"773\",\"total_user_time\": \"953\"},\"Adobe TypeKit\": {\"bytes\": \"162558\",\"end_time\": \"895\",\"requests\": \"4\",\"serial_time\": \"38\",\"start_time\": \"446\",\"total_user_time\": \"449\"},\"Cloudfront\": {\"bytes\": \"21578\",\"end_time\": \"2241\",\"requests\": \"1\",\"serial_time\": \"26\",\"start_time\": \"2215\",\"total_user_time\": \"26\"}}}" | kv | spath thirdParty output=_raw | kv | fields *.total_user_time, | fields - thirdParty.* _raw, _time
| rename *.total_user_time as * | transpose column_name=Site | rename "row 1" as total_user_time

Thanks