Splunk Search

How to refer to JSON array object in a Splunk search?

caagrawal
New Member

Hi,

I have a JSON data in following format. How can I access individual element of the array?

{ [-] 
    LICENSES: [ [-] 
      AFL and GPLv2+ 
      AFL or GPLv2 
      Apache 
      Apache 2.0 
 ]
}

If I write search: | table LICENSES{}, it prints all licenses, however, I want to access an individual element as in first license or 2nd license. If I do something like table LICESNES{0} or table LICENSES{}.{0} etc ..nothing works. Please help.

Tags (4)
0 Karma

asimagu
Builder

As far as I know, Splunk extracts the Json data into fields and by default the field names get the name after its corresponding trace in the Json object.

So, in your case LICENSES is a multivalue field , so in order to access each value you could do it like this

 | eval firstValue=mvIndex(LICENSES,0)  | eval secondValue=mvIndex(LICENSES,1) ....

and then table the results

... | table firstValue secondValue
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...