Splunk Search

How to create a kvpair from two automatically extracted JSON arrays?

mjones414
Contributor

I'm in a situation where by sourcetype, I'm already having a nested JSON array broken into 2 fields: DeviceProperties{}.Name and DeviceProperties{}.Value  there are 16 elements in each array.

I'm trying to simply create a field name that is the value of the second element in DeviceProperties{}.Name and the Value is the value of the second element in DeviceProperties{}.Value.  In this scenario I think I can get away with just creating a field with just DeviceProperties{1}.Value but I haven't been successful in doing that.

I've tried using the json_extract function, but I think I am getting the syntax wrong, and I havent found any examples yet that are trying to do this exact scenario where the json array was already created as a multivalue field.

Labels (1)
Tags (1)
0 Karma
1 Solution

rymundo_splunk
Splunk Employee
Splunk Employee

Hi, hopefully I understood your question correctly.  Can you try this out and see if it's doing what you want it to do?

| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| eval fieldName=mvindex('stuff{}.name',1),
value=mvindex('stuff{}.value',1),
{fieldName}=value
| table *

View solution in original post

mjones414
Contributor

You are legendarily awesome in my week this week!  Thank you!  If you're gonna be at .conf2022, I'd love to buy you a drink to show my appreciation.

rymundo_splunk
Splunk Employee
Splunk Employee

Hi, hopefully I understood your question correctly.  Can you try this out and see if it's doing what you want it to do?

| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| eval fieldName=mvindex('stuff{}.name',1),
value=mvindex('stuff{}.value',1),
{fieldName}=value
| table *

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...