Splunk Search

json extract with non-existing fields

Albsoguero
New Member

Hi,

 

I have a json where not all the elements have all the fields. How can we extract and show this in a table?

 

For example:

 

"{

"node" :" node1",

"Command_output_interface" : [

        {

                  "TABLE_interface" : {

                            "ROW_interface" : [

                                     {

                                                 "interface" : "ethernet1/1",

                                                 "description" : "local",

                                     }

                                    {

                                                 "interface" : "ethernet1/2",

                                     }

                                     {

                                                 "interface" : "ethernet1/3",

                                                 "description" : "wan",

                                     }

                            ]

             }

}

]

}"

 

As you can see, ethernet1/2 is not having description.

 

When I try to table it using Spath and mvzip and mvextract, it is not working fine because it is shown in this way:

node               interface             description

node1           ethernet1/1       local

node1           ethernet1/2       wan

node1           ethernet1/3

 

And of course I want the following result, where there is no description for ethernet1/2:

     

node               interface             description

node1           ethernet1/1       local

node1           ethernet1/2       

node1           ethernet1/3       wan

 

Can you help me? Seems simple but I haven't been able to find the way.

 

Regards,

Labels (1)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw 
| eval _raw="{\"node\":\" node1\",\"Command_output_interface\":[{\"TABLE_interface\":{\"ROW_interface\":[{\"interface\":\"ethernet1/1\",\"description\":\"local\"},{\"interface\":\"ethernet1/2\"},{\"interface\":\"ethernet1/3\",\"description\":\"wan\"}]}}]}"
| rename COMMNENT as "this is your sample. check this. from here, the logic"
| spath Command_output_interface{}.TABLE_interface.ROW_interface{} output=Coi
| spath node
| stats values(node) as node by Coi
| spath input=Coi
| fields - Coi
| table node interface description
0 Karma

Albsoguero
New Member

Yeah!! It worked totally for me. :slightly_smiling_face:

 

Now I have to understand it. :winking_face:

 

Regards!

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...