Splunk Search

How to create a kvpair from two automatically extracted JSON arrays?

mjones414
Contributor

I'm in a situation where by sourcetype, I'm already having a nested JSON array broken into 2 fields: DeviceProperties{}.Name and DeviceProperties{}.Value  there are 16 elements in each array.

I'm trying to simply create a field name that is the value of the second element in DeviceProperties{}.Name and the Value is the value of the second element in DeviceProperties{}.Value.  In this scenario I think I can get away with just creating a field with just DeviceProperties{1}.Value but I haven't been successful in doing that.

I've tried using the json_extract function, but I think I am getting the syntax wrong, and I havent found any examples yet that are trying to do this exact scenario where the json array was already created as a multivalue field.

Labels (1)
Tags (1)
0 Karma
1 Solution

rymundo_splunk
Splunk Employee
Splunk Employee

Hi, hopefully I understood your question correctly.  Can you try this out and see if it's doing what you want it to do?

| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| eval fieldName=mvindex('stuff{}.name',1),
value=mvindex('stuff{}.value',1),
{fieldName}=value
| table *

View solution in original post

mjones414
Contributor

You are legendarily awesome in my week this week!  Thank you!  If you're gonna be at .conf2022, I'd love to buy you a drink to show my appreciation.

rymundo_splunk
Splunk Employee
Splunk Employee

Hi, hopefully I understood your question correctly.  Can you try this out and see if it's doing what you want it to do?

| makeresults
| eval json="{ \"stuff\":[{\"name\": \"name0\", \"value\": \"value0\"},{\"name\": \"name1\", \"value\": \"value1\"}] }"
| spath input=json
| eval fieldName=mvindex('stuff{}.name',1),
value=mvindex('stuff{}.value',1),
{fieldName}=value
| table *

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...