Splunk Search

How to convert array of json in multiple split lines?

felipesodre
Path Finder

Any help is greatly appreciated.

 

How to convert the following json into a table?

{
"Summary":{
"jobType":"jobA",
"summaryId":22746666,
"objectsArchived":[
{
"name":"tableA",
"count":855
},
{
"name":"tableB",
"count":678
}
]
}
}

 

Jobtype | SummaryId | Table | Count

jobA.        | 22746666.  | tableA | 855

jobA.         | 22746666  | tableB | 678

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath Summary.objectsArchived{} output=objectsArchived
| mvexpand objectsArchived
| spath Summary.jobType output=jobType
| spath Summary.summaryId output=summaryId
| spath input=objectsArchived
| rename name as Table
| table jobType summaryId Table count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath Summary.objectsArchived{} output=objectsArchived
| mvexpand objectsArchived
| spath Summary.jobType output=jobType
| spath Summary.summaryId output=summaryId
| spath input=objectsArchived
| rename name as Table
| table jobType summaryId Table count
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...