Splunk Search

How to create this table with json arrays

VasistaI
Explorer

hi i'm new to splunk. need some help.
I have below script: 

| spath input=message
| search env=prod clAppNam="i-app" demographics.firstName != null 
| table usrId, pId, email{}.emailTypeCode,email{}.emailAddress
| outputcsv Upsert_party_Address_Report

 

This results in below report:
usrid  pid    emailTypeCode   emailAddress

1          222  home                        [email protected]

                       work                        [email protected]

1          333  work                        [email protected]

                        correspond         [email protected]

1          444   home                     [email protected]

I need the results as shown below.. 

usrid  pid    emailTypeCode   emailAddress

1          222  home                        [email protected]

1          222  work                        [email protected]

1          333  work                        [email protected]

1          333  correspond         [email protected]

1          444   home                     [email protected]

Any help is greatly appreciated..

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

......
| spath input=message
| search env=prod clAppNam="i-app" demographics.firstName != null 
| table usrId, pId, email{}.emailTypeCode,email{}.emailAddress
| eval temp=mvzip('email{}.emailTypeCode','email{}.emailAddress',"##")
| mvexpand temp | rex field=temp "(?<emailTypeCode>[^#]+)##(?<emailAddress>.+)" | fields - temp
| rename emailTypeCode as email{}.emailTypeCode, emailAddress as  email{}.emailAddress
| outputcsv Upsert_party_Address_Report 

View solution in original post

somesoni2
Revered Legend

Try like this

......
| spath input=message
| search env=prod clAppNam="i-app" demographics.firstName != null 
| table usrId, pId, email{}.emailTypeCode,email{}.emailAddress
| eval temp=mvzip('email{}.emailTypeCode','email{}.emailAddress',"##")
| mvexpand temp | rex field=temp "(?<emailTypeCode>[^#]+)##(?<emailAddress>.+)" | fields - temp
| rename emailTypeCode as email{}.emailTypeCode, emailAddress as  email{}.emailAddress
| outputcsv Upsert_party_Address_Report 

VasistaI
Explorer

this solution worked. Thank you so much for the help!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're looking for the filldown command.

| spath input=message
| search env=prod clAppNam="i-app" demographics.firstName != null 
| table usrId, pId, email{}.emailTypeCode,email{}.emailAddress
| filldown usrId pId
| outputcsv Upsert_party_Address_Report 

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

VasistaI
Explorer

unfortunately the filldown did not work.. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

 Splunk is excited to announce the General Availability of Federated Search for Dynamic Data Self Storage ...

Index This | What has many keys but can’t unlock a door?

July 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...