How to Parse Json array with inner condition?

[ofer_s]

I cant seem to find an example parsing a json array with no parent.

Meaning, I need to parse: [{"key1":"value2}, {"key1", "value2}].

But I only see examples with: "{"MyList" : [{"key1":"value2}, {"key1", "value2}]}

This is the json I have:

[{
	"id": "123",
	"percentage": 25.0,
	"active": true,
	"second_id": "456",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 3,
		"minutes": 4,
		"seconds": 2
	}
}, {
		"id": "789",
	"percentage": 56.0,
	"active": true,
	"second_id": "222",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 6,
		"minutes": 2,
		"seconds": 2
	}
}]

I need to filter only the records which their event_age>4 and present it in a table.

id	percentage	active	second_id	creation time	event_age
789	56	true	222	2022-04-13T09:30:06.517	hours: 6, minutes :6, seconds: 2

Thanks! 

[kamlesh_vaghela]

@ofer_s 

You can extract your required values using below search. Here, you need to change where condition as per your requirement. I have 

YOUR_SEARCH 
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4

My Sample Search :

| makeresults | eval _raw="[{\"id\": \"123\",\"percentage\": 25.0,\"active\": true,\"second_id\": \"456\",\"creation time\": \"2022-04-13T09:30:06.517\",\"event_age\": {\"hours\": 3,\"minutes\": 4,\"seconds\": 2}}, {\"id\": \"789\",\"percentage\": 56.0,\"active\": true,\"second_id\": \"222\",\"creation time\": \"2022-04-13T09:30:06.517\",	\"event_age\": {\"hours\": 6,\"minutes\": 2,\"seconds\": 2}}]" 
|rename comment as "Upto now is for sample data only" 
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4

Screenshot 2022-04-13 at 6.37.51 PM.png

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.