Splunk Search

How to create fields based on multivalue field of keys, and multivalue field of values

denissotoacc
Path Finder

I have the following json event:

 

{
  "tags": 
  [
    {"key":"Name","value":"Damian"},
    {"key":"Age","value":34},
    {"key":"Country","value":"Argentina"},
    {"key":"City","value":"Buenos Aires"}
  ]
}

 


I need to extract the correspondent fields in my event, with the key and value:

Name="Damian"
Age="34"
Country="Argentina"
City="Buenos Aires"

This is what I tried:

 

| spath path=tags{}.key output=a_keys
| spath path=tags{}.value output=a_values
| eval {a_keys} = a_value

 

 

But the result of it is a multivalued field:

Name Age Country City = [ "Damian", "34", "Argentina", "Buenos Aires" ]

How can I create the correct fields?

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=tags{}.key output=a_keys
| spath path=tags{}.value output=a_values
| streamstats count as _event
| eval n_values=mvrange(0,mvcount(a_keys))
| mvexpand n_values
| foreach a_*
    [| eval _key=mvindex(a_keys,n_values)
    | eval {_key}=mvindex(a_values,n_values)]
| stats values(*) as * values(_*) as _* by _event
| fields - n_values

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=tags{}.key output=a_keys
| spath path=tags{}.value output=a_values
| streamstats count as _event
| eval n_values=mvrange(0,mvcount(a_keys))
| mvexpand n_values
| foreach a_*
    [| eval _key=mvindex(a_keys,n_values)
    | eval {_key}=mvindex(a_values,n_values)]
| stats values(*) as * values(_*) as _* by _event
| fields - n_values
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...