Hi,
I am trying to extract the json fields where one of the fields name can change between "stringValue" or "doubleValie" and this list could be quite long , in below example I have given only two elements.
"Diagnostic": {
"Version": 2,
"diagnostic_list": [
{
"name": "FUND",
"stringValue": "One year"
},
{
"name": "RATE",
"doubleValue": 10
},
{
"name": "DATE",
"stringValue": "2016-01-01"
}
}
My json is similar to this:
rename Diagnostic{}.* as * | eval values=mvzip(name, stringValue) | mvexpand values | eval values = split(values,",") | eval name=mvindex(values,0) | eval name=mvindex(values,1) | where name=="FUND"
As you can see the problem is stringValue above could be doubleValue, so in my results I see this when i write above fields in table, the second column i.e. stringValue sometimes doesnt align with the corresponding "name" field in table.
How can I switch between stringValue and doubleValue at the run time?
Thanks,
Prashant
... View more