Splunk Search

JSON to table

email2vamsi
Explorer

Hello experts,

I would like to display this json to the table mentioned below.
Please help. Thank you.

{"body":[{"srl":"1A","Num":60,"Type":"x1"},
{"srl":"2A","Type":"x2"}],
"date":1585522807308}

srl---Num---Type
~~~~~~~~~~~~
1A---60 ----x1
2A--None---x2

0 Karma
1 Solution

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}" 
| spath path=body{} output=temp 
| mvexpand temp 
| spath input=temp 
| fillnull value="None" 
| table srl,Num,Type

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}" 
| spath path=body{} output=temp 
| mvexpand temp 
| spath input=temp 
| fillnull value="None" 
| table srl,Num,Type

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@email2vamsi

Can you please try this?

YOUR_SEARCH  | spath path=body{} output=b |mvexpand b | eval _raw=b | extract | fillnull value="None" | table srl Num Type

Sample Search

| makeresults 
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}" 
| spath path=body{} output=b |mvexpand b | eval _raw=b | extract | fillnull value="None" | table srl Num Type

Thanks

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!