Search code examples
splunksplunk-query

splunk how to extract object to table


example event

{
  "test": {
   "x": "y",
   "a": "b",
   "code": {
     "one" : {
       "two": {
         "c": "d"
       }
     }
   }
 }
}

how can I extract some parts of code block and present them as table. example

one | c

I have tried putting together a query but not sure how to extract specific fields

| spath
| spath test.code{} output=code
| mvexpand code

Solution

  • | makeresults
    | eval _raw="{
      \"test\": {
       \"x\": \"y\",
       \"a\": \"b\",
       \"code\": {
         \"one\" : {
           \"two\": {
             \"c\": \"d\"
           }
         }
       }
     }
    }"
    | spath test.code output=code
    | table code
    | spath input=code
    

    the key idea here is the input=code, Spath command takes input as an option argument for which field to find the json to extract the values from. Spath link

    the results from the example given are:

    Results from query