Splunk Search

How to extract the first element from the JSON element based on a field match?

Chandra
New Member

I want to extract the json object based on a single field match from below string message.

 

payload ::[{"name","suman", "age":"22"},{"name","raman", "age":"32"}]

 

 If the age is 22 then print {"name","suman", "age":"22"} 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<nameage>\{\"name\",\"[^\"]+\", \"age\":\"22\"\})"

However, given that this is not valid JSON, you might want to change the first comma (,) to a colon (:) to match JSON format. You also might need to include some white spaces (\s) in the match strings. (Since you have obviously provided a dummy example, there may be other tweaks you need to make!)

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Note your JSON illustration is invalid.  I assume you meant

{"payload":[{"name":"suman", "age":"22"},{"name":"raman", "age":"32"}]}

(This means that you have fields like payload{}.name and payload{}.age.)  You can use mvexpand then search, like

| spath path=payload{}
| mvexpand payload{}
| spath input=payload{}
| where age == "22"

Or, you can use mvfind with mvindex, like

| eval match_name = mvindex('payload{}.name', mvfind('payload{}.age', "22"))
| eval match = json_object("age", "22", "name", match_name)
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...