example event
{
"test": {
"x": "y",
"a": "b",
"code": {
"one" : {
"two": {
"c": "d"
}
}
}
}
}
how can I extract some parts of code
block and present them as table. example
one | c
I have tried putting together a query but not sure how to extract specific fields
| spath
| spath test.code{} output=code
| mvexpand code
| makeresults
| eval _raw="{
\"test\": {
\"x\": \"y\",
\"a\": \"b\",
\"code\": {
\"one\" : {
\"two\": {
\"c\": \"d\"
}
}
}
}
}"
| spath test.code output=code
| table code
| spath input=code
the key idea here is the input=code, Spath command takes input as an option argument for which field to find the json to extract the values from. Spath link
the results from the example given are: