Splunk Search
Highlighted

JSON to table

Explorer

Hello experts,

I would like to display this json to the table mentioned below.
Please help. Thank you.

{"body":[{"srl":"1A","Num":60,"Type":"x1"},
{"srl":"2A","Type":"x2"}],
"date":1585522807308}

srl---Num---Type
~~~~~~~~~~~~
1A---60 ----x1
2A--None---x2

0 Karma
Highlighted

Re: JSON to table

SplunkTrust
SplunkTrust

@email2vamsi

Can you please try this?

YOUR_SEARCH  | spath path=body{} output=b |mvexpand b | eval _raw=b | extract | fillnull value="None" | table srl Num Type

Sample Search

| makeresults 
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}" 
| spath path=body{} output=b |mvexpand b | eval _raw=b | extract | fillnull value="None" | table srl Num Type

Thanks

Highlighted

Re: JSON to table

Champion

Hi

Give a try

| makeresults 
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}" 
| spath path=body{} output=temp 
| mvexpand temp 
| spath input=temp 
| fillnull value="None" 
| table srl,Num,Type

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.