Splunk Search

How to convert array of json in multiple split lines?

felipesodre
Path Finder

Any help is greatly appreciated.

 

How to convert the following json into a table?

{
"Summary":{
"jobType":"jobA",
"summaryId":22746666,
"objectsArchived":[
{
"name":"tableA",
"count":855
},
{
"name":"tableB",
"count":678
}
]
}
}

 

Jobtype | SummaryId | Table | Count

jobA.        | 22746666.  | tableA | 855

jobA.         | 22746666  | tableB | 678

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath Summary.objectsArchived{} output=objectsArchived
| mvexpand objectsArchived
| spath Summary.jobType output=jobType
| spath Summary.summaryId output=summaryId
| spath input=objectsArchived
| rename name as Table
| table jobType summaryId Table count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath Summary.objectsArchived{} output=objectsArchived
| mvexpand objectsArchived
| spath Summary.jobType output=jobType
| spath Summary.summaryId output=summaryId
| spath input=objectsArchived
| rename name as Table
| table jobType summaryId Table count
Get Updates on the Splunk Community!

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...