×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
sammagana
Loves-to-Learn
Member since: ‎11-18-2020
‎11-20-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎11-18-2020
Activity Feed
Topics I've Started
View All

Re: Parsing double nested JSON

by in Splunk Search
‎11-20-2020 07:51 AM
‎11-20-2020 07:51 AM
Hi!, Thanks for the help. Really appreciate it.  It seems that with this query I am only able to return the list of software?  The attributes don't generate in the columns.   Any suggestion?   Thank you!  ... View more

Re: Parsing double nested JSON

by in Splunk Search
‎11-19-2020 08:21 AM
‎11-19-2020 08:21 AM
Yes, I do expect more then one license field in the event. Here is my Raw Event: "features": { "Acceleration": { "licenses": [ { "version": "v20", "vendor_daemon": "cstd", "expiration_date": "2021-07-16", "type": "floating", "parse_status": "SUCCESS", "parse_error": null } ], "num_issued": 5, "num_used": 3, "num_available": 2, "parse_status": "SUCCESS", "parse_error": null }, "fronter": { "licenses": [], "num_issued": 5, "num_used": 0, "num_available": 5, "parse_status": "SUCCESS", "parse_error": null }, "start": { "licenses": [ { "version": "v20", "vendor_daemon": "cstd", "expiration_date": "2021-07-16", "type": "floating", "parse_status": "SUCCESS", "parse_error": null } ], "num_issued": 5, "num_used": 1, "num_available": 4, "parse_status": "SUCCESS", "parse_error": null }, "En_FSP": { "licenses": [], "num_issued": 1, "num_used": 0, "num_available": 1, "parse_status": "SUCCESS", "parse_error": null }, "OS_Linux": { "licenses": [], "num_issued": 5, "num_used": 0, "num_available": 5, "parse_status": "SUCCESS", "parse_error": null },   Is this what your looking for? ... View more

Parsing double nested JSON

by in Splunk Search
‎11-18-2020 04:57 PM
‎11-18-2020 04:57 PM
Hello, So I am having some trouble parsing this json file to pull out the nested contents of the 'licenses'.  My current search can grab the contents of the inner json within 'features' but not the nested 'licenses' portion. My current search looks like this:       index=someindex | fields features.*.* | rename features.* as * | eval FieldList="" | foreach * [ eval FieldList=if("<<MATCHSTR>>"!="FieldList",FieldList.","."<<MATCHSTR>>","") ] | eval FieldList=split(FieldList,",") | mvexpand FieldList | eval Software=mvindex(split(FieldList,"."),0),Column=mvindex(split(FieldList,"."),1) | eval value="" | foreach * [ eval value=if("<<FIELD>>"==Software.".".Column,'<<FIELD>>',value),{Column}=value ]        sample json file: "features": { "M_TOOL": { "licenses": [], "num_issued": 40, "num_used": 0, "num_available": 40, "parse_status": "SUCCESS", "parse_error": null }, "M_GUI": { "licenses": [], "num_issued": 40, "num_used": 0, "num_available": 40, "parse_status": "SUCCESS", "parse_error": null }, "MT_GUI": { "licenses": [], "num_issued": 40, "num_used": 0, "num_available": 40, "parse_status": "SUCCESS", "parse_error": null }, "M_TOOL": { "licenses": [], "num_issued": 40, "num_used": 0, "num_available": 40, "parse_status": "SUCCESS", "parse_error": null }, "ML_GUI": { "licenses": [], "num_issued": 40, "num_used": 0, "num_available": 40, "parse_status": "SUCCESS", "parse_error": null }, "C_SOLVTOOL_Ser": { "licenses": [], "num_issued": 40, "num_used": 0, "num_available": 40, "parse_status": "SUCCESS", "parse_error": null }, "CP_SOLVTOOL_Par": { "licenses": [], "num_issued": 600, "num_used": 0, "num_available": 600, "parse_status": "SUCCESS", "parse_error": null }, "CD_SOLVTOOL_Ext": { "licenses": [], "num_issued": 20000, "num_used": 0, "num_available": 20000, "parse_status": "SUCCESS", "parse_error": null }, "C_SOLV_Ser": { "licenses": [ { "version": , "vendor_daemon": "mcomp", "expiration_date": "2021-08-31", "type": "floating", "parse_status": "SUCCESS", "parse_error": null } ], "num_issued": 40, "num_used": 16, "num_available": 24, "parse_status": "SUCCESS", "parse_error": null } } Ideally I'd like to put the contents into some table to start vendor_daemon expiration_date type parse_status parse_error mcomp 2021-08-31 floating SUCCESS null Thank you so much! Appreciate any and all help! ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎11-20-2020 05:59 PM