Splunk Search

display all values of JSON field in a table if you don't know the structure of the json

dasaed
Explorer

I have a JSON with a field containing another object, but this object varies depending on type. For example, you may have these 3 logs under the same sourcetype/index:

{ "Log":"something","user": "me" ,"type":"car", "data": {"case1":"something"} }
{ "Log":"something","user": "me" ,"type":"apple", "data": {"fruity":"yummy"} }
{ "Log":"something","user": "me","type":"Cauliflower", "data":{"veggie":"eww", "fact":"good for you"} }

and I want a table query to look something like this:
user | data
me    | {"case1":"something"} 
me    | {"fruity":"yummy"}
me    | {"veggie":"eww", "fact":"good for you"}

I tried the following query:
index=mylog | table user,data
but my results usually look like this (with either nulls or straight up empty):
user | data
me    | null
me    |
me    | null

data itself may sometimes be very long, but I would still like to see its entire output in the table. How can I go about this?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=user
| spath path=data
| table user data

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| spath path=user
| spath path=data
| table user data

yuanliu
SplunkTrust
SplunkTrust

path=user is not necessary for this dataset.  But that's a great illustration of path option in spath!

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried index=mylog | table user,data.* ?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...