Splunk Search

which is more better structure when use json array

ktaeil
Engager

when i made a log for HEC with json array, im not sure what is more better way to use spl.

can someone advise me please?

way 1. 

{host: 'test'

lists : [{

                   id: ' list1'

                   ip: '192.168.0.1'

                   device: 'laptop'

                   value: 123

                   },

                 {

                   id: ' list2'

                   ip: '192.168.0.2'

                   device: 'phone'

                   value: 1223

                   },

                 {

                   id: ' list3'

                   ip: '192.168.0.3'

                   device: 'desktop'

                   value: 99

                   },

]}

 

way2.

{host: 'test'

list1 :{

                   id: ' list1'

                   ip: '192.168.0.1'

                   device: 'laptop'

                   value: 123

             }

list2 : {

                   id: ' list2'

                   ip: '192.168.0.2'

                   device: 'phone'

                   value: 1223

                   },

list3:   {

                   id: ' list3'

                   ip: '192.168.0.3'

                   device: 'desktop'

                   value: 99

                   },

]}

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

It is interesting that you pose the question in regard to SPL instead of a data structure consideration.  But still, while array is a viable structure for many applications, SPL is not the only language that has to go to extra length to handle.  If you have a choice, and if you don't care much about front-end compute, hash is easier on SPL. (And again, easier in some use cases with other languages.)

I do want to suggest, though, you drop the nested listX.id node because that is redundant. (Lastly, I also recommend that you illustrate with compliant JSON.  This makes volunteers work easier.)

{"host": "test",

"list1" :{

                  "ip": "192.168.0.1",

                   "device": "laptop",

                   "value": 123

             },

"list2" : {

                   "ip": "192.168.0.2",

                   "device": "phone",

                   "value": 1223

                   },

"list3":   {

                   "ip": "192.168.0.3",

                   "device": "desktop",

                   "value": 99

                   }

}

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...