How to extract value from JSON then declare a variable?

[yiweishih]

I have HEC to send an event to Splunk in JSON format:

{ 
   Status: Down
   Source: GCP
   URL: url_1
}
{ 
   Status: Up
   Source: GCP
   URL: url_2
}
{ 
   Status: Down
   Source: AWS
   URL: url_1
}
{ 
   Status: Up
   Source: AWS
   URL: url_2
}

I want to extract value from JSON then declare a variable, not sure should I use eval or stats
For example:
declare a variable usl_1_aws_status, it should be Down
declare a variable usl_2_gcp_status, it should be UP

How to do I extract value from JSON then declare a variable?

[yuanliu · Accepted solution]

The easiest is perhaps transpose.

| eval site_status=URL . "_" . Source . "_status"
| table site_status Status
| transpose header_field=site_status
| fields - column

The sample data gives

url_1_GCP_status	url_2_GCP_status	url_1_AWS_status	url_2_AWS_status
Down	Up	Down	Up

[yiweishih]

It worked!! Thank you so much!