Splunk Search

which is more better structure when use json array

ktaeil
Engager

when i made a log for HEC with json array, im not sure what is more better way to use spl.

can someone advise me please?

way 1. 

{host: 'test'

lists : [{

                   id: ' list1'

                   ip: '192.168.0.1'

                   device: 'laptop'

                   value: 123

                   },

                 {

                   id: ' list2'

                   ip: '192.168.0.2'

                   device: 'phone'

                   value: 1223

                   },

                 {

                   id: ' list3'

                   ip: '192.168.0.3'

                   device: 'desktop'

                   value: 99

                   },

]}

 

way2.

{host: 'test'

list1 :{

                   id: ' list1'

                   ip: '192.168.0.1'

                   device: 'laptop'

                   value: 123

             }

list2 : {

                   id: ' list2'

                   ip: '192.168.0.2'

                   device: 'phone'

                   value: 1223

                   },

list3:   {

                   id: ' list3'

                   ip: '192.168.0.3'

                   device: 'desktop'

                   value: 99

                   },

]}

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

It is interesting that you pose the question in regard to SPL instead of a data structure consideration.  But still, while array is a viable structure for many applications, SPL is not the only language that has to go to extra length to handle.  If you have a choice, and if you don't care much about front-end compute, hash is easier on SPL. (And again, easier in some use cases with other languages.)

I do want to suggest, though, you drop the nested listX.id node because that is redundant. (Lastly, I also recommend that you illustrate with compliant JSON.  This makes volunteers work easier.)

{"host": "test",

"list1" :{

                  "ip": "192.168.0.1",

                   "device": "laptop",

                   "value": 123

             },

"list2" : {

                   "ip": "192.168.0.2",

                   "device": "phone",

                   "value": 1223

                   },

"list3":   {

                   "ip": "192.168.0.3",

                   "device": "desktop",

                   "value": 99

                   }

}

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...