Hi @shaunm001 How about something like this? Its not perfect but should work. Be careful using REX as can be resource intensive, although iterating over things like this is never perfect. Could be ...
See more...
Hi @shaunm001 How about something like this? Its not perfect but should work. Be careful using REX as can be resource intensive, although iterating over things like this is never perfect. Could be some other ways using mvexpand too but tried to avoid that! I've added some sample data for you to see how it might work! | makeresults
| eval _raw="{
\"id\": \"12345\",
\"params\": [
{
\"key\": \"name\",
\"value\": \"Splunker1\"
},
{
\"key\": \"score\",
\"value\": 100
},
{
\"key\": \"department\",
\"value\": \"support\"
}
]
}"
| eval _raw=json_extract(_raw,"")
| eval params=json_array_to_mv(json_extract(_raw,"params"))
| foreach params mode=multivalue [
| eval val_<<ITER>>=mvindex(params,<<ITER>>) ]
| foreach val_*
[| eval fieldName=json_extract(mvindex(params, <<MATCHSTR>>),"key"), {fieldName}=json_extract(mvindex(params, <<MATCHSTR>>),"value") ]
| fields - params val_* Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped. Regards Will