Hi everyone, I have a json data payload as below: {
location: US
all_results: {
serial_a: {
result: PASS,
version: 123,
data:[
data1,
data2,
data3
]
},
serial_b: {
result: PASS,
version: 456,
data:[
data4,
data5
]
},
serial_c: {
result: FAIL,
version: 789,
data:[
data6,
data7
]
}
}
} and I would like to use splunk query and make a table as: serial_number result version data serial_a PASS 123 data1, data2, data3 serial_b PASS 456 data4, data5, serial_c fail 789 data6, data7 how to use splunk query to organize the result? I know I'm able to grab the data by: | spath path=all_results output=all_results | eval all_results=json_extract(all_results) The difficult part is at the serial_number. They have some common prefix serial, but it's dynamic. Therefore , when I try to grab the data inside serial_number, for example version, I'm not able to use query like: | spath output=version path=all_result.serial*.version Could you give me some idea to do that? thank you!
... View more
