Splunk doesn't recognize square brackets as denoting a JSON array; they identify a subsearch. We also can't reference a JSON array element by name. Perhaps some day... Here's a run-anywhere query showing one way to accomplish the task. | makeresults
| eval _raw="{
\"appName\": \"TestApp\",
\"eventType\": \"Response\",
\"msg\": {
\"transId\": \"Trans1234\",
\"status\": \"Success\",
\"client\": \"clientXyz\",
\"responseTime\": 1650,
\"details\": [
{
\"keyName\": \"rtt\",
\"keyValue\": 2778
},
{
\"keyName\": \"trace\",
\"keyValue\": 97007839130680
}
],
\"url\": \"/v1/test\"
}
}" | spath
``` Everything above sets up test data. Delete IRL. ```
``` Combine keyName and keyValue so we can work with them as a pair. ```
| eval foo=mvzip('msg.details{}.keyName','msg.details{}.keyValue')
``` Locate "trace" keys ```
| eval foo=mvindex(foo,mvfind(foo,"trace"))
``` Break up the keyName/keyValue pair for display ```
| eval foo=split(foo,",")
| eval keyName=mvindex(foo,0), keyValue=mvindex(foo,1)
| table msg.transId, msg.status, keyName, keyValue
... View more
