Hello experts,
I would like to display this json to the table mentioned below.
Please help. Thank you.
{"body":[{"srl":"1A","Num":60,"Type":"x1"},
{"srl":"2A","Type":"x2"}],
"date":1585522807308}
srl---Num---Type
~~~~~~~~~~~~
1A---60 ----x1
2A--None---x2
Hi
Give a try
| makeresults
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}"
| spath path=body{} output=temp
| mvexpand temp
| spath input=temp
| fillnull value="None"
| table srl,Num,Type
Hi
Give a try
| makeresults
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}"
| spath path=body{} output=temp
| mvexpand temp
| spath input=temp
| fillnull value="None"
| table srl,Num,Type
@email2vamsi
Can you please try this?
YOUR_SEARCH | spath path=body{} output=b |mvexpand b | eval _raw=b | extract | fillnull value="None" | table srl Num Type
Sample Search
| makeresults
| eval _raw="{\"body\":[{\"srl\":\"1A\",\"Num\":60,\"Type\":\"x1\"},{\"srl\":\"2A\",\"Type\":\"x2\"}],\"date\":\"1585522807308\"}"
| spath path=body{} output=b |mvexpand b | eval _raw=b | extract | fillnull value="None" | table srl Num Type
Thanks