Is there any way to get the fields and its expression from datamodel

[sivaranjiniG]

Hello,

Is there any way to get fieldname and its expression from datamodel using rest api(using splunk query)?

I am already using this query but here fields and its expressions are shuffled.

| datamodel 
| spath output=modelName modelName
|search modelName=Network_Traffic
|rex max_match=0 field=_raw "\[\{\"fieldName\":\"(?<fields>[^\"]+)\""
|rex max_match=0 field=_raw "\"expression\":\"(?<expression>.*?)\"}"
|table fields expression

[livehybrid · Accepted solution]

Does the following search help? This uses json_ functions and mvexpand to split out and then match up the fields and expressions:

| datamodel 
| spath output=modelName modelName
|search modelName=Network_Traffic
| eval objects=json_array_to_mv(json_extract(_raw,"objects"))
| mvexpand objects
| eval calculations=json_array_to_mv(json_extract(objects,"calculations"))
| mvexpand calculations
| eval outputFields=json_array_to_mv(json_extract(calculations,"outputFields"))
| mvexpand outputFields
| eval fieldName=json_extract(outputFields,"fieldName")
| eval expression=json_extract(calculations,"expression")
| table modelName fieldName expression