json to table

[vinod0313]

Hello 

I have a log like below,which is having JSON object

FEATURES=[
{
"featureName":"TOKEN_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate the JWT token"
},
{
"featureName":"REQUETS_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate request URL"
},
{
"featureName":"REQUEST_PAYLOAD_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate request body"
},
{
"featureName":"RESPONSE_PAYLOAD_VALIDATION",
"addedIn":"1.0.7",
"description":"This feature is used to Validate response body"
},
{
"featureName":"AOP",
"addedIn":"1.0.6",
"description":"This feature is used to check method execution time"
},
{
"featureName":"TIBCO_COMMUNICATOR",
"addedIn":"1.0.8",
"description":"This feature is used to connect Benefits service "
},
{
"featureName":"SECRETS_SECURE",
"addedIn":"1.0.7",
"description":"This feature is used to Validate"
}
]



I want the out put table should be as shown in below

featureName                                                 addedIn                             description

TOKEN_VALIDATION                                      1.0.7                           This feature is used to Validate the JWT token
REQUETS_VALIDATION                                 1.0.7                           This feature is used to Validate request URL
REQUEST_PAYLOAD_VALIDATION           1.0.7                           This feature is used to Validate request body
RESPONSE_PAYLOAD_VALIDATION        1.0.7                           This feature is used to Validate response body
AOP                                                                        1.0.6                    This feature is used to check method execution time
TIBCO_COMMUNICATOR                             1.0.8                     This feature is used to connect Benefits service
SECRETS_SECURE                                          1.0.7                      This feature is used to Validate SECRETS

[to4kawa · Accepted solution]

index=_internal | head 1 | fields _raw | eval FEATURES="[{\"featureName\":\"TOKEN_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate the JWT token\"},{\"featureName\":\"REQUETS_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate request URL\"},{\"featureName\":\"REQUEST_PAYLOAD_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate request body\"},{\"featureName\":\"RESPONSE_PAYLOAD_VALIDATION\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate response body\"},{\"featureName\":\"AOP\",\"addedIn\":\"1.0.6\",\"description\":\"This feature is used to check method execution time\"},{\"featureName\":\"TIBCO_COMMUNICATOR\",\"addedIn\":\"1.0.8\",\"description\":\"This feature is used to connect Benefits service \"},{\"featureName\":\"SECRETS_SECURE\",\"addedIn\":\"1.0.7\",\"description\":\"This feature is used to Validate\"}]"
| spath input=FEATURES {} output=raw
| stats count by raw
| spath input=raw
| table featureName,addedIn,description

[vinod0313]

I am getting result as shown below

i am getting the order in alphabetical order.

if it come as in json object order,I mean Token_validation is first,Request_validation second so on.

But thanks for the solution

[to4kawa]

| stats count by raw → | mvexpand raw