How to get eval assignment of a nested JSON list does not assign?

[splunked38]

Hi,

I'm trying to assign a list from a nested JSON event 

{
	"timestamp": "2023-06-14T18:03:57.047201+00:00",
	.
	.
	"records": [
		{
			"type": "A",
			"value": []
		},
		{
			"type": "AAAA",
			"value": []
		},
		{
			"type": "CNAME",
			"value": []
		},
		{
			"type": "NS",
			"value": [
				"ns-0.blah.com",
				"ns-1.blah.org",
				"ns-1.blah.co.uk",
				"ns-1.blah.net"
			]
		}
	],
	"metadata": {
	.
	.
	}
}

  
using this query

index=test
| eval records=mvindex('records{}.value{}', mvfind('records{}.type',"NS"))

instead of getting all 4 entries in the list, I only got one entry (there is no other field similar to 'records', 'value', 'type')

ns-1.blah.net

Side comparison,  to show that a list can be assigned via an eval, when I collapse the nesting (removing the 'records' level) and adjusting the query, it's reads all 4 values (so it doesn't appear to be a variable 'type' problem)

index=test
| eval records='value{}'

{
	"timestamp": "2023-06-14T17:00:00.123073+02:00",
	.
	.
	"value": [
		"ns-0.blah.com",
		"ns-1.blah.co.uk",
		"ns-1.blah.net",
		"ns-1.blah.org"
	],
	.
	.
	
}

ns-0.blah.com
ns-1.blah.co.uk
ns-1.blah.net
ns-1.blah.org

[splunked38]

Awesome, works, I forgot about the grouping, thanks @ITWhisperer for your help.

[ITWhisperer · Accepted solution]

JSON parsing will have grouped all the values together. You need to break out the records collection, find the part you need (NS), then extract those values.

| spath output=records records{}
| eval records=mvindex('records', mvfind('records{}.type',"NS"))
| spath input=records value{}