Hi all,
I would like to index JSON data like this, My ultimate aim is to move the fields(college, university, examdate) to the individual array element and index.
college=college1 studentname=name1 mark=98 subject=science university=university1 examdate=10-12-14
college=college1 studentname=name2 mark=99 subject=science university=university1 examdate=10-12-14
college=college2 studentname=name21 mark=80 subject=science university=university1 examdate=10-12-14
college=college2 studentname=name22 mark=100 subject=science university=university1 examdate=10-12-14
Sample JSON,
{
"studentsmarks": {
"subject": "science",
"university": "university1",
"examdate": "10-12-14"
},
"students": [
{
"college": "college1",
"studentname": "name1",
"mark": "98"
},
{
"college": "college1",
"studentname": "name2",
"mark": "99"
},
{
"college": "college2",
"studentname": "name21",
"mark": "80"
},
{
"college": "college2",
"studentname": "name22",
"mark": "100"
}
]
}
Cheeerrss!
run this search :
| gentimes start=-1 | eval temp="{\"studentsmarks\":{\"subject\":\"science\",\"university\":\"university1\",\"examdate\":\"10-12-14\"},\"students\":[{\"college\":\"college1\",\"studentname\":\"name1\",\"mark\":\"98\"},{\"college\":\"college1\",\"studentname\":\"name2\",\"mark\":\"99\"},{\"college\":\"college2\",\"studentname\":\"name21\",\"mark\":\"80\"},{\"college\":\"college2\",\"studentname\":\"name22\",\"mark\":\"100\"}]}" | table temp | rename temp as _raw | spath | rename students{}.* as * |rename studentsmarks.* as * | eval temp=mvzip(college,mvzip(mark,studentname,"#"),"#") | mvexpand temp | rex field=temp "(?.*)#(?.*)#(?.*)" |table college university examdate | outputcsv your_csv_name
after go to /splunk_home/var/run/splunk/ directry and you shall see your_csv_name.csv ;
Then you Recuper in the directory your csv file and you can index your_csv_name.csv file
Hey,
How this will help me? are you ask me to index twice? then what happen to the license?
I would like to handle it in index time.