Splunk Search

Splunk to split 1 json entry with multiple event times into multiple entries with multiple event times

sssignals
Path Finder

Hi Splunk community

My data in json format has 1 entry in Splunk that contain 1 event size and 1 event time for the same flowKey like the following:

{"_id":{"$oid":"dfkahu13fd"},"flowKey":"null,null,...", "size_of_events":[1.1121358e+08],"time_of_events":[{"$numberLong":"1548454548"}],...}

I also have 1 entry with multiple event size and event time for another flowKey which looks like the following:

{"_id":{"$oid":"dfsahu13fd"},"flowKey":"null,null,...", "size_of_events":[1.1121356e+08,1.1121357e+08,1.1121357e+08,1.1121358e+08],"time_of_events":[{"$numberLong":"1548454548"},{"$numberLong":"1548454549"},{"$numberLong":"1548454555"},{"$numberLong":"1548454559"}],...}

Pls advise how I can break the latter one into 4 events with the same flowKey. My aim is to show using a timechart with x as event time and y as event size for all entries.
Hopefully I can hack it in search. Am not good with props.conf.
Many thanks in advance.

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

Assuming you have those 2 fields extracted as multivalued fields eventsizes and eventtimes, you can do this:

...
| eval eventdetails = mvzip(eventsizes,eventtimes,";")
| mvexpand eventdetails
| rex field=eventdetails "^(?<eventsize>[^;]+);(?<eventtime>.+)"

The mvzip joins the 2 multivalued fields row by row into a single multivalued field with ; separated eventsize and eventtime values.
The mvexpand explodes that into separate events (copying all other field values like flowKey
The rex is then used to extract the two parts from the eventdetails field.

View solution in original post

FrankVl
Ultra Champion

Assuming you have those 2 fields extracted as multivalued fields eventsizes and eventtimes, you can do this:

...
| eval eventdetails = mvzip(eventsizes,eventtimes,";")
| mvexpand eventdetails
| rex field=eventdetails "^(?<eventsize>[^;]+);(?<eventtime>.+)"

The mvzip joins the 2 multivalued fields row by row into a single multivalued field with ; separated eventsize and eventtime values.
The mvexpand explodes that into separate events (copying all other field values like flowKey
The rex is then used to extract the two parts from the eventdetails field.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...