Splunk Search

How to split Json array using Splunk Search commands??

ajayabburi508
Path Finder

My Query is :

|inputlookup geo_jj | eval types = "{\"geom\": " + geom + "}" | spath input=types

i got output in geom column is :

geom

{"type":"MultiPolygon","coordinates":[[[[-105.8203125,31.052934646606445],[-105.8203125,48.806861877441406],[-88.06640625,48.806861877441406],[-88.06640625,31.052934646606445],[-105.8203125,31.052934646606445]]]]}

But i want output like this

value1 value2
-105.8203125 31.052934646606445
-105.8203125 48.806861877441406
-88.06640625 48.806861877441406
-88.06640625 31.052934646606445
-105.8203125 31.052934646606445

Please help me for this

0 Karma
1 Solution

493669
Super Champion

Hi @ajayabburi508,
try this regex:

|rex max_match=0 field=geom "\[(?<value1>-[^,]+),(?<value2>[^]]+)"

after this to separate multivalue fields you can try :

|eval combined=mvzip(value1,value2)| mvexpand combined
 | makemv combined delim=","  
|eval lat=mvindex(combined,0), lon=mvindex(combined,1)

View solution in original post

493669
Super Champion

Hi @ajayabburi508,
try this regex:

|rex max_match=0 field=geom "\[(?<value1>-[^,]+),(?<value2>[^]]+)"

after this to separate multivalue fields you can try :

|eval combined=mvzip(value1,value2)| mvexpand combined
 | makemv combined delim=","  
|eval lat=mvindex(combined,0), lon=mvindex(combined,1)

ajayabburi508
Path Finder

Thanks 493669 alot ,it is working good

0 Karma

493669
Super Champion

Glad to help:) please accept the answer so that it will no longer open.

0 Karma

ajayabburi508
Path Finder

Accepted bro

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...