Need some help with a JSON array

[ScottW]

Hi smart folks. I have the output of a REST API call as seen below. I need to split each of the records as delimited by the {} as it's own event with each of the key:values defined for each record. 

[

  {

    "name": "ESSENTIAL",

    "status": "ENABLED",

    "compliance": "COMPLIANT",

    "consumptionCounter": 17,

    "daysOutOfCompliance": "-",

    "lastAuthorization": "Dec 11,2024 07:32:21 AM"

  },

  {

    "name": "ADVANTAGE",

    "status": "ENABLED",

    "compliance": "EVALUATION",

    "consumptionCounter": 0,

    "daysOutOfCompliance": "-",

    "lastAuthorization": "Jul 09,2024 22:49:25 PM"

  },

  {

    "name": "PREMIER",

    "status": "ENABLED",

    "compliance": "EVALUATION",

    "consumptionCounter": 0,

    "daysOutOfCompliance": "-",

    "lastAuthorization": "Aug 10,2024 21:10:44 PM"

  },

  {

    "name": "DEVICEADMIN",

    "status": "ENABLED",

    "compliance": "COMPLIANT",

    "consumptionCounter": 2,

    "daysOutOfCompliance": "-",

    "lastAuthorization": "Dec 11,2024 07:32:21 AM"

  },

  {

    "name": "VM",

    "status": "ENABLED",

    "compliance": "COMPLIANT",

    "consumptionCounter": 2,

    "daysOutOfCompliance": "-",

    "lastAuthorization": "Dec 11,2024 07:32:21 AM"

  }

]

Thanks in advance for any help you all might offer to get me down the right track.

[bowesmana]

Assuming this is the output of a search, then make the search do this with that data - this assumes raw is a field containing that data

| eval json=json_array_to_mv(raw)
| fields - raw _time
| mvexpand json
| spath input=json
| fields - json

[ScottW]

Thank you for the help. This got me to the following:

I am hoping to get to the point where the individual fields like "name" and "consumptionCounter" become their own fields so that I can do things like trend over time, average, etc.

[ScottW]

This got me on the right track and let me to the following:

[richgalloway]

It would help to know what you've tried already so we don't waste time on that.

Consider these props settings

[mysourcetype]
DATETIME_CONFIG = current
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\{
TRANSFORMS-parse_mysourcetype = parse_mysourcetype

with these transforms:

[parse_mysourcetype]
REGEX = "([^"]+)":"([^"]+)
FORMAT = $1::$2

[ScottW]

Hi Rich,

I am starting from scratch here and am not a Splunk whisperer, so really starting from ground zero.