Splunk Search

How to extract the first element from the JSON element based on a field match?

Chandra
New Member

I want to extract the json object based on a single field match from below string message.

 

payload ::[{"name","suman", "age":"22"},{"name","raman", "age":"32"}]

 

 If the age is 22 then print {"name","suman", "age":"22"} 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<nameage>\{\"name\",\"[^\"]+\", \"age\":\"22\"\})"

However, given that this is not valid JSON, you might want to change the first comma (,) to a colon (:) to match JSON format. You also might need to include some white spaces (\s) in the match strings. (Since you have obviously provided a dummy example, there may be other tweaks you need to make!)

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Note your JSON illustration is invalid.  I assume you meant

{"payload":[{"name":"suman", "age":"22"},{"name":"raman", "age":"32"}]}

(This means that you have fields like payload{}.name and payload{}.age.)  You can use mvexpand then search, like

| spath path=payload{}
| mvexpand payload{}
| spath input=payload{}
| where age == "22"

Or, you can use mvfind with mvindex, like

| eval match_name = mvindex('payload{}.name', mvfind('payload{}.age', "22"))
| eval match = json_object("age", "22", "name", match_name)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...