Splunk Search

which is more better structure when use json array

ktaeil
Engager

when i made a log for HEC with json array, im not sure what is more better way to use spl.

can someone advise me please?

way 1. 

{host: 'test'

lists : [{

                   id: ' list1'

                   ip: '192.168.0.1'

                   device: 'laptop'

                   value: 123

                   },

                 {

                   id: ' list2'

                   ip: '192.168.0.2'

                   device: 'phone'

                   value: 1223

                   },

                 {

                   id: ' list3'

                   ip: '192.168.0.3'

                   device: 'desktop'

                   value: 99

                   },

]}

 

way2.

{host: 'test'

list1 :{

                   id: ' list1'

                   ip: '192.168.0.1'

                   device: 'laptop'

                   value: 123

             }

list2 : {

                   id: ' list2'

                   ip: '192.168.0.2'

                   device: 'phone'

                   value: 1223

                   },

list3:   {

                   id: ' list3'

                   ip: '192.168.0.3'

                   device: 'desktop'

                   value: 99

                   },

]}

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

It is interesting that you pose the question in regard to SPL instead of a data structure consideration.  But still, while array is a viable structure for many applications, SPL is not the only language that has to go to extra length to handle.  If you have a choice, and if you don't care much about front-end compute, hash is easier on SPL. (And again, easier in some use cases with other languages.)

I do want to suggest, though, you drop the nested listX.id node because that is redundant. (Lastly, I also recommend that you illustrate with compliant JSON.  This makes volunteers work easier.)

{"host": "test",

"list1" :{

                  "ip": "192.168.0.1",

                   "device": "laptop",

                   "value": 123

             },

"list2" : {

                   "ip": "192.168.0.2",

                   "device": "phone",

                   "value": 1223

                   },

"list3":   {

                   "ip": "192.168.0.3",

                   "device": "desktop",

                   "value": 99

                   }

}

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...