Splunk Search

How to Parse Json array with inner condition?

ofer_s
Loves-to-Learn

I cant seem to find an example parsing a json array with no parent.

Meaning, I need to parse: [{"key1":"value2}, {"key1", "value2}].

But I only see examples with: "{"MyList" : [{"key1":"value2}, {"key1", "value2}]}

 

This is the json I have:

 

 

 

 

 

[{
	"id": "123",
	"percentage": 25.0,
	"active": true,
	"second_id": "456",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 3,
		"minutes": 4,
		"seconds": 2
	}
}, {
		"id": "789",
	"percentage": 56.0,
	"active": true,
	"second_id": "222",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 6,
		"minutes": 2,
		"seconds": 2
	}
}]

 

 

 

 

 

I need to filter only the records which their event_age>4 and present it in a table.

id percentage active second_id creation time event_age
789 56 true 222 2022-04-13T09:30:06.517 hours: 6,
minutes :6,
seconds: 2

 

Thanks! 

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ofer_s 

You can extract your required values using below search. Here, you need to change where condition as per your requirement. I have 

 

 

YOUR_SEARCH 
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4

 

 

My Sample Search :

 

 

| makeresults | eval _raw="[{\"id\": \"123\",\"percentage\": 25.0,\"active\": true,\"second_id\": \"456\",\"creation time\": \"2022-04-13T09:30:06.517\",\"event_age\": {\"hours\": 3,\"minutes\": 4,\"seconds\": 2}}, {\"id\": \"789\",\"percentage\": 56.0,\"active\": true,\"second_id\": \"222\",\"creation time\": \"2022-04-13T09:30:06.517\",	\"event_age\": {\"hours\": 6,\"minutes\": 2,\"seconds\": 2}}]" 
|rename comment as "Upto now is for sample data only" 
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4

 


 

Screenshot 2022-04-13 at 6.37.51 PM.png

 

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...