Splunk Search

How to Parse Json array with inner condition?


I cant seem to find an example parsing a json array with no parent.

Meaning, I need to parse: [{"key1":"value2}, {"key1", "value2}].

But I only see examples with: "{"MyList" : [{"key1":"value2}, {"key1", "value2}]}


This is the json I have:






	"id": "123",
	"percentage": 25.0,
	"active": true,
	"second_id": "456",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 3,
		"minutes": 4,
		"seconds": 2
}, {
		"id": "789",
	"percentage": 56.0,
	"active": true,
	"second_id": "222",
	"creation time": "2022-04-13T09:30:06.517",
	"event_age": {
		"hours": 6,
		"minutes": 2,
		"seconds": 2






I need to filter only the records which their event_age>4 and present it in a table.

id percentage active second_id creation time event_age
789 56 true 222 2022-04-13T09:30:06.517 hours: 6,
minutes :6,
seconds: 2



Labels (1)
0 Karma



You can extract your required values using below search. Here, you need to change where condition as per your requirement. I have 



| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4



My Sample Search :



| makeresults | eval _raw="[{\"id\": \"123\",\"percentage\": 25.0,\"active\": true,\"second_id\": \"456\",\"creation time\": \"2022-04-13T09:30:06.517\",\"event_age\": {\"hours\": 3,\"minutes\": 4,\"seconds\": 2}}, {\"id\": \"789\",\"percentage\": 56.0,\"active\": true,\"second_id\": \"222\",\"creation time\": \"2022-04-13T09:30:06.517\",	\"event_age\": {\"hours\": 6,\"minutes\": 2,\"seconds\": 2}}]" 
|rename comment as "Upto now is for sample data only" 
| spath path={} output=raw | mvexpand raw | rename raw as _raw | spath
| where 'event_age.hours' > 4



Screenshot 2022-04-13 at 6.37.51 PM.png



If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...