Splunk Search

How to create fields based on multivalue field of keys, and multivalue field of values

denissotoacc
Path Finder

I have the following json event:

 

{
  "tags": 
  [
    {"key":"Name","value":"Damian"},
    {"key":"Age","value":34},
    {"key":"Country","value":"Argentina"},
    {"key":"City","value":"Buenos Aires"}
  ]
}

 


I need to extract the correspondent fields in my event, with the key and value:

Name="Damian"
Age="34"
Country="Argentina"
City="Buenos Aires"

This is what I tried:

 

| spath path=tags{}.key output=a_keys
| spath path=tags{}.value output=a_values
| eval {a_keys} = a_value

 

 

But the result of it is a multivalued field:

Name Age Country City = [ "Damian", "34", "Argentina", "Buenos Aires" ]

How can I create the correct fields?

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=tags{}.key output=a_keys
| spath path=tags{}.value output=a_values
| streamstats count as _event
| eval n_values=mvrange(0,mvcount(a_keys))
| mvexpand n_values
| foreach a_*
    [| eval _key=mvindex(a_keys,n_values)
    | eval {_key}=mvindex(a_values,n_values)]
| stats values(*) as * values(_*) as _* by _event
| fields - n_values

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=tags{}.key output=a_keys
| spath path=tags{}.value output=a_values
| streamstats count as _event
| eval n_values=mvrange(0,mvcount(a_keys))
| mvexpand n_values
| foreach a_*
    [| eval _key=mvindex(a_keys,n_values)
    | eval {_key}=mvindex(a_values,n_values)]
| stats values(*) as * values(_*) as _* by _event
| fields - n_values
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...