Splunk Search

How to create a kvpair from two automatically extracted JSON arrays?

mjones414
Contributor

I'm in a situation where by sourcetype, I'm already having a nested JSON array broken into 2 fields: DeviceProperties{}.Name and DeviceProperties{}.Value  there are 16 elements in each array.

I'm trying to simply create a field name that is the value of the second element in DeviceProperties{}.Name and the Value is the value of the second element in DeviceProperties{}.Value.  In this scenario I think I can get away with just creating a field with just DeviceProperties{1}.Value but I haven't been successful in doing that.

I've tried using the json_extract function, but I think I am getting the syntax wrong, and I havent found any examples yet that are trying to do this exact scenario where the json array was already created as a multivalue field.

Labels (1)
Tags (1)
0 Karma
1 Solution

rymundo_splunk
Splunk Employee
Splunk Employee

Hi, hopefully I understood your question correctly.  Can you try this out and see if it's doing what you want it to do?

| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| eval fieldName=mvindex('stuff{}.name',1),
value=mvindex('stuff{}.value',1),
{fieldName}=value
| table *

View solution in original post

mjones414
Contributor

You are legendarily awesome in my week this week!  Thank you!  If you're gonna be at .conf2022, I'd love to buy you a drink to show my appreciation.

rymundo_splunk
Splunk Employee
Splunk Employee

Hi, hopefully I understood your question correctly.  Can you try this out and see if it's doing what you want it to do?

| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| eval fieldName=mvindex('stuff{}.name',1),
value=mvindex('stuff{}.value',1),
{fieldName}=value
| table *

Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...