Good day everyone Someone here will have had experience obtaining values from a JSON.. Currently I have _raws in JSON format from which I try to obtain a table that shows in a single row the values of the object that has the array with the most data. I better explain myself with the following example: This is the JSON code that comes in each event: {
"investigationStatus":"New",
"status":1,
"priorityScore":38,
"workbenchName":"PSEXEC Execution By Process",
"workbenchId":"WB-18286-20231106-00005",
"severity":"low",
"caseId":null,
"detail":{
"schemaVersion":"1.14",
"alertProvider":"SAE",
"description":"PSEXEC execution to start remote process",
"impactScope":[
{
"entityValue":{
"name":"SERVER01",
},
"relatedIndicators":[
2
]
},
{
"entityValue":{
"name":"SERVER02",
},
"relatedIndicators":[
2,
3
]
},
{
"entityValue":{
"name":"SERVER03",
},
"relatedIndicators":[
1,
2,
3,
4
]
},
{
"entityValue":{
"name":"SERVER04",
},
"relatedIndicators":[
1
]
}
]
}
} And this is the table I'm trying to get: workbenchId workbenchName severity name_host "WB-18286-20231106-00005" "PSEXEC Execution By Process" "low" "SERVER03" If you can see, the values of the 1st level of the JSON are found, and then there is the host_name SERVER03, since this has the largest number of values in the "relatedIndicators" array (from 1 to 4), the rest of the servers do not because they have smaller amount in the array. Maybe any idea how I could achieve it? I tried with json_extract but didn't succeed
... View more