I cant seem to find an example parsing a json array with no parent.
Meaning, I need to parse: [{"key1":"value2}, {"key1", "value2}].
But I only see examples with: "{"MyList" : [{"key1":"value2}, {"key1", "value2}]}
This is the json I have:
[{
"id": "123",
"percentage": 25.0,
"active": true,
"second_id": "456",
"creation time": "2022-04-13T09:30:06.517",
"event_age": {
"hours": 3,
"minutes": 4,
"seconds": 2
}
}, {
"id": "789",
"percentage": 56.0,
"active": true,
"second_id": "222",
"creation time": "2022-04-13T09:30:06.517",
"event_age": {
"hours": 6,
"minutes": 2,
"seconds": 2
}
}]
I need to filter only the records which their event_age>4 and present it in a table.
id | percentage | active | second_id | creation time | event_age |
789 | 56 | true | 222 | 2022-04-13T09:30:06.517 | hours: 6, minutes :6, seconds: 2 |
Thanks!
You can extract your required values using below search. Here, you need to change where condition as per your requirement. I have
YOUR_SEARCH
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4
My Sample Search :
| makeresults | eval _raw="[{\"id\": \"123\",\"percentage\": 25.0,\"active\": true,\"second_id\": \"456\",\"creation time\": \"2022-04-13T09:30:06.517\",\"event_age\": {\"hours\": 3,\"minutes\": 4,\"seconds\": 2}}, {\"id\": \"789\",\"percentage\": 56.0,\"active\": true,\"second_id\": \"222\",\"creation time\": \"2022-04-13T09:30:06.517\", \"event_age\": {\"hours\": 6,\"minutes\": 2,\"seconds\": 2}}]"
|rename comment as "Upto now is for sample data only"
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4
Thanks
KV
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.