Splunk Search

How to create fields based on multivalue field of keys, and multivalue field of values

denissotoacc
Path Finder

I have the following json event:

 

{
  "tags": 
  [
    {"key":"Name","value":"Damian"},
    {"key":"Age","value":34},
    {"key":"Country","value":"Argentina"},
    {"key":"City","value":"Buenos Aires"}
  ]
}

 


I need to extract the correspondent fields in my event, with the key and value:

Name="Damian"
Age="34"
Country="Argentina"
City="Buenos Aires"

This is what I tried:

 

| spath path=tags{}.key output=a_keys
| spath path=tags{}.value output=a_values
| eval {a_keys} = a_value

 

 

But the result of it is a multivalued field:

Name Age Country City = [ "Damian", "34", "Argentina", "Buenos Aires" ]

How can I create the correct fields?

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=tags{}.key output=a_keys
| spath path=tags{}.value output=a_values
| streamstats count as _event
| eval n_values=mvrange(0,mvcount(a_keys))
| mvexpand n_values
| foreach a_*
    [| eval _key=mvindex(a_keys,n_values)
    | eval {_key}=mvindex(a_values,n_values)]
| stats values(*) as * values(_*) as _* by _event
| fields - n_values

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=tags{}.key output=a_keys
| spath path=tags{}.value output=a_values
| streamstats count as _event
| eval n_values=mvrange(0,mvcount(a_keys))
| mvexpand n_values
| foreach a_*
    [| eval _key=mvindex(a_keys,n_values)
    | eval {_key}=mvindex(a_values,n_values)]
| stats values(*) as * values(_*) as _* by _event
| fields - n_values
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...