Splunk Search

How to create this table with json arrays

VasistaI
Explorer

hi i'm new to splunk. need some help.
I have below script: 

| spath input=message
| search env=prod clAppNam="i-app" demographics.firstName != null 
| table usrId, pId, email{}.emailTypeCode,email{}.emailAddress
| outputcsv Upsert_party_Address_Report

 

This results in below report:
usrid  pid    emailTypeCode   emailAddress

1          222  home                        [email protected]

                       work                        [email protected]

1          333  work                        [email protected]

                        correspond         [email protected]

1          444   home                     [email protected]

I need the results as shown below.. 

usrid  pid    emailTypeCode   emailAddress

1          222  home                        [email protected]

1          222  work                        [email protected]

1          333  work                        [email protected]

1          333  correspond         [email protected]

1          444   home                     [email protected]

Any help is greatly appreciated..

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

......
| spath input=message
| search env=prod clAppNam="i-app" demographics.firstName != null 
| table usrId, pId, email{}.emailTypeCode,email{}.emailAddress
| eval temp=mvzip('email{}.emailTypeCode','email{}.emailAddress',"##")
| mvexpand temp | rex field=temp "(?<emailTypeCode>[^#]+)##(?<emailAddress>.+)" | fields - temp
| rename emailTypeCode as email{}.emailTypeCode, emailAddress as  email{}.emailAddress
| outputcsv Upsert_party_Address_Report 

View solution in original post

somesoni2
Revered Legend

Try like this

......
| spath input=message
| search env=prod clAppNam="i-app" demographics.firstName != null 
| table usrId, pId, email{}.emailTypeCode,email{}.emailAddress
| eval temp=mvzip('email{}.emailTypeCode','email{}.emailAddress',"##")
| mvexpand temp | rex field=temp "(?<emailTypeCode>[^#]+)##(?<emailAddress>.+)" | fields - temp
| rename emailTypeCode as email{}.emailTypeCode, emailAddress as  email{}.emailAddress
| outputcsv Upsert_party_Address_Report 

VasistaI
Explorer

this solution worked. Thank you so much for the help!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You're looking for the filldown command.

| spath input=message
| search env=prod clAppNam="i-app" demographics.firstName != null 
| table usrId, pId, email{}.emailTypeCode,email{}.emailAddress
| filldown usrId pId
| outputcsv Upsert_party_Address_Report 

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

VasistaI
Explorer

unfortunately the filldown did not work.. 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...