Splunk Search

JSON to table

email2vamsi
Explorer

Hello experts,

I would like to display this json to the table mentioned below.
Please help. Thank you.

{"body":[{"srl":"1A","Num":60,"Type":"x1"},
{"srl":"2A","Type":"x2"}],
"date":1585522807308}

srl---Num---Type
~~~~~~~~~~~~
1A---60 ----x1
2A--None---x2

0 Karma
1 Solution

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}" 
| spath path=body{} output=temp 
| mvexpand temp 
| spath input=temp 
| fillnull value="None" 
| table srl,Num,Type

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}" 
| spath path=body{} output=temp 
| mvexpand temp 
| spath input=temp 
| fillnull value="None" 
| table srl,Num,Type
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@email2vamsi

Can you please try this?

YOUR_SEARCH  | spath path=body{} output=b |mvexpand b | eval _raw=b | extract | fillnull value="None" | table srl Num Type

Sample Search

| makeresults 
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}" 
| spath path=body{} output=b |mvexpand b | eval _raw=b | extract | fillnull value="None" | table srl Num Type

Thanks

Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...