Splunk Search

How to Parse Json array with inner condition?

ofer_s
Loves-to-Learn

I cant seem to find an example parsing a json array with no parent.

Meaning, I need to parse: [{"key1":"value2}, {"key1", "value2}].

But I only see examples with: "{"MyList" : [{"key1":"value2}, {"key1", "value2}]}

 

This is the json I have:

 

 

 

 

 

[{
	"id": "123",
	"percentage": 25.0,
	"active": true,
	"second_id": "456",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 3,
		"minutes": 4,
		"seconds": 2
	}
}, {
		"id": "789",
	"percentage": 56.0,
	"active": true,
	"second_id": "222",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 6,
		"minutes": 2,
		"seconds": 2
	}
}]

 

 

 

 

 

I need to filter only the records which their event_age>4 and present it in a table.

id percentage active second_id creation time event_age
789 56 true 222 2022-04-13T09:30:06.517 hours: 6,
minutes :6,
seconds: 2

 

Thanks! 

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ofer_s 

You can extract your required values using below search. Here, you need to change where condition as per your requirement. I have 

 

 

YOUR_SEARCH 
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4

 

 

My Sample Search :

 

 

| makeresults | eval _raw="[{\"id\": \"123\",\"percentage\": 25.0,\"active\": true,\"second_id\": \"456\",\"creation time\": \"2022-04-13T09:30:06.517\",\"event_age\": {\"hours\": 3,\"minutes\": 4,\"seconds\": 2}}, {\"id\": \"789\",\"percentage\": 56.0,\"active\": true,\"second_id\": \"222\",\"creation time\": \"2022-04-13T09:30:06.517\",	\"event_age\": {\"hours\": 6,\"minutes\": 2,\"seconds\": 2}}]" 
|rename comment as "Upto now is for sample data only" 
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4

 


 

Screenshot 2022-04-13 at 6.37.51 PM.png

 

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...