I'm in a situation where by sourcetype, I'm already having a nested JSON array broken into 2 fields: DeviceProperties{}.Name and DeviceProperties{}.Value there are 16 elements in each array.
I'm trying to simply create a field name that is the value of the second element in DeviceProperties{}.Name and the Value is the value of the second element in DeviceProperties{}.Value. In this scenario I think I can get away with just creating a field with just DeviceProperties{1}.Value but I haven't been successful in doing that.
I've tried using the json_extract function, but I think I am getting the syntax wrong, and I havent found any examples yet that are trying to do this exact scenario where the json array was already created as a multivalue field.
Hi, hopefully I understood your question correctly. Can you try this out and see if it's doing what you want it to do?
| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| eval fieldName=mvindex('stuff{}.name',1),
value=mvindex('stuff{}.value',1),
{fieldName}=value
| table *
You are legendarily awesome in my week this week! Thank you! If you're gonna be at .conf2022, I'd love to buy you a drink to show my appreciation.
Hi, hopefully I understood your question correctly. Can you try this out and see if it's doing what you want it to do?
| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| eval fieldName=mvindex('stuff{}.name',1),
value=mvindex('stuff{}.value',1),
{fieldName}=value
| table *