Splunk Search

How to convert array of json in multiple split lines?

felipesodre
Path Finder

Any help is greatly appreciated.

 

How to convert the following json into a table?

{
"Summary":{
"jobType":"jobA",
"summaryId":22746666,
"objectsArchived":[
{
"name":"tableA",
"count":855
},
{
"name":"tableB",
"count":678
}
]
}
}

 

Jobtype | SummaryId | Table | Count

jobA.        | 22746666.  | tableA | 855

jobA.         | 22746666  | tableB | 678

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath Summary.objectsArchived{} output=objectsArchived
| mvexpand objectsArchived
| spath Summary.jobType output=jobType
| spath Summary.summaryId output=summaryId
| spath input=objectsArchived
| rename name as Table
| table jobType summaryId Table count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath Summary.objectsArchived{} output=objectsArchived
| mvexpand objectsArchived
| spath Summary.jobType output=jobType
| spath Summary.summaryId output=summaryId
| spath input=objectsArchived
| rename name as Table
| table jobType summaryId Table count
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...