Splunk Search

How to Parse Json array with inner condition?

ofer_s
Loves-to-Learn

I cant seem to find an example parsing a json array with no parent.

Meaning, I need to parse: [{"key1":"value2}, {"key1", "value2}].

But I only see examples with: "{"MyList" : [{"key1":"value2}, {"key1", "value2}]}

 

This is the json I have:

 

 

 

 

 

[{
	"id": "123",
	"percentage": 25.0,
	"active": true,
	"second_id": "456",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 3,
		"minutes": 4,
		"seconds": 2
	}
}, {
		"id": "789",
	"percentage": 56.0,
	"active": true,
	"second_id": "222",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 6,
		"minutes": 2,
		"seconds": 2
	}
}]

 

 

 

 

 

I need to filter only the records which their event_age>4 and present it in a table.

id percentage active second_id creation time event_age
789 56 true 222 2022-04-13T09:30:06.517 hours: 6,
minutes :6,
seconds: 2

 

Thanks! 

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ofer_s 

You can extract your required values using below search. Here, you need to change where condition as per your requirement. I have 

 

 

YOUR_SEARCH 
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4

 

 

My Sample Search :

 

 

| makeresults | eval _raw="[{\"id\": \"123\",\"percentage\": 25.0,\"active\": true,\"second_id\": \"456\",\"creation time\": \"2022-04-13T09:30:06.517\",\"event_age\": {\"hours\": 3,\"minutes\": 4,\"seconds\": 2}}, {\"id\": \"789\",\"percentage\": 56.0,\"active\": true,\"second_id\": \"222\",\"creation time\": \"2022-04-13T09:30:06.517\",	\"event_age\": {\"hours\": 6,\"minutes\": 2,\"seconds\": 2}}]" 
|rename comment as "Upto now is for sample data only" 
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4

 


 

Screenshot 2022-04-13 at 6.37.51 PM.png

 

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...