Getting Data In

Extract Json data

spyme72
Path Finder

i want to extract all the attributes in the following Json string and use it to populate a dropdown.

This is the first time i am working with Json string hence confused on how to use spath to extract all the attributes. i would have used rex if it was a string, please help.

{[-]
DIR_CLIENT_ORAHOME : "/oracle/C08/920_64",
DIR_CT_RUN : "/usr/sap/C08/SYS/exe/run",
DIR_EXECUTABLE : "/usr/sap/C08/DVEBMGS15/exe",
DIR_ORAHOME : "/oracle/C08/920_64",
DIR_PUT : "/usr/sap/SUM/abap",
DIR_SERVER_ORAHOME : "/oracle/C08/920_64",
INSTANCE_NAME : "DVEBMGS15",
OS_UNICODE : "uc",
PHYS_MEMSIZE : "16384",
SAPDBHOST : "stluc08cnb01",
SAPGLOBALHOST : "stc08a00",
SAPSYSTEM : "15",
SAPSYSTEMNAME : "C08",
abap/atrasizequota : "50000",
abap/buffersize : "3148000",
abap/fieldexit : "yes",
abap/heap_area_dia : "3000000000",
abap/heap_area_nondia : "5368709120",
abap/heap_area_total : "10737418240",
abap/heaplimit : "50000000",
abap/shared_objects_size_MB : "25",
alert/MONI_SEGM_SIZE : "80000000",
auth/auth_number_in_userbuffer : "9000",
auth/no_check_in_some_cases : "Y",
auth/object_disabling_active : "N",
auth/tcodes_not_checked : "null",
csa/second_language : "E",
dbms/type : "ora",
dbs/ora/plan_table : "UH",
dbs/ora/tnsname : "c08-scan/stc08a00_C08_15",
em/global_area_MB : "2048",
em/initial_size_MB : "14336",
em/max_size_MB : "24576",
enque/table_size : "65536",
es/implementation : "std",
exe/icmbnd : "$(DIR_CT_RUN)/icmbnd",
gw/cpic_timeout : "40",
gw/max_conn : "2000",
gw/max_conn_per_wp : "20",
gw/max_overflow_size : "25000000",
gw/max_sys : "2000",
icm/HTTP/logging_0 : "PREFIX=/, LOGFILE=icmhttp.log, LOGFORMAT=SAPSMD, MAXSIZEKB=10240, SWITCHTF=day, FILEWRAP=on",
icm/host_name_full : "stc08a00.monsanto.com",
icm/keep_alive_timeout : "90",
icm/max_conn : "16384",
icm/max_sockets : "16384",
icm/max_threads : "250",
icm/min_threads : "100",
icm/req_queue_len : "6000",
icm/server_port_0 : "PROT=HTTPS,PORT=80$$",
icm/server_port_1 : "PROT=SMTP,PORT=0,PROCTIMEOUT=1200,TIMEOUT=60",
install/umask : "002",
ipc/shm_psize_10 : "224000000",
ipc/shm_psize_40 : "734000000",
itsp/Security/allow_designs_from : "myhost,stcepa00.monsanto.com,cep.monsanto.com",
login/accept_sso2_ticket : "1",
login/create_sso2_ticket : "1",
login/failed_user_auto_unlock : "0",
login/fails_to_session_end : "3",
login/fails_to_user_lock : "6",
login/min_password_digits : "1",
login/min_password_letters : "1",
login/min_password_lng : "6",
login/min_password_specials : "1",
login/no_automatic_user_sapstar : "1",
login/password_expiration_time : "90",
login/password_history_size : "1",
login/system_client : "208",
mpi/total_size_MB : "500",
ms/acl_info : "/usr/sap/C08/SYS/global/ms_acl_info",
nobuf/max_no_buffer_entries : "2000",
rdisp/PG_MAXFS : "491520",
rdisp/PG_SHM : "98304",
rdisp/ROLL_MAXFS : "163840",
rdisp/ROLL_SHM : "32768",
rdisp/accept_remote_trace_level : "0",
rdisp/appc_ca_blk_no : "3000",
rdisp/btcname : "stc08a00_C08_15",
rdisp/btctime : "20",
rdisp/bufrefmode : "sendon,exeauto",
rdisp/elem_per_queue : "4000",
rdisp/enqname : "stc08a00_C08_15",
rdisp/gui_auto_logout : "1800",
rdisp/max_arq : "2500",
rdisp/max_comm_entries : "2500",
rdisp/max_wprun_time : "1800",
rdisp/mshost : "stc08a00",
rdisp/msserv_internal : "3915",
rdisp/plugin_auto_logout : "900",
rdisp/rfc_check : "3",
rdisp/rfc_max_own_used_wp : "25",
rdisp/rfc_min_wait_dia_wp : "10",
rdisp/sna_gateway : "stc08a00",
rdisp/sna_gw_service : "sapgw15",
rdisp/tm_max_no : "2000",
rdisp/vbname : "stc08a00_C08_15",
rdisp/wp_ca_blk_no : "2000",
rdisp/wp_no_btc : "6",
rdisp/wp_no_dia : "30",
rdisp/wp_no_enq : "1",
rdisp/wp_no_spo : "1",
rdisp/wp_no_vb : "4",
rdisp/wp_no_vb2 : "4",
rsau/enable : "1",
rsau/selection_slots : "10",
rsdb/cua/buffersize : "240000",
rsdb/max_blocking_factor : "20",
rsdb/max_in_blocking_factor : "20",
rsdb/max_union_blocking_factor : "20",
rsdb/ntab/entrycount : "150000",
rsdb/ntab/ftabsize : "240000",
rsdb/ntab/irbdsize : "80000",
rsdb/ntab/sntabsize : "3500",
rsdb/obj/buffersize : "450000",
rsdb/obj/max_objects : "55000",
rsdb/prefer_fix_blocking : "1",
rsdb/ssfs_connect : "1",
rsec/ssfs_datapath : "$(DIR_GLOBAL)$(DIR_SEP)security$(DIR_SEP)rsecssfs$(DIR_SEP)data",
rsec/ssfs_keypath : "$(DIR_GLOBAL)$(DIR_SEP)security$(DIR_SEP)rsecssfs$(DIR_SEP)key",
rslg/max_diskspace/central : "5000000",
rslg/send_daemon/listen_port : "1215",
rslg/send_daemon/talk_port : "1315",
rspo/global_shm/printer_list : "4500",
rspo/spool_id/max_number : "200000",
rtbb/buffer_length : "80000",
rtbb/max_tables : "500",
sap/bufdir_entries : "10000",
sapgui/user_scripting : "TRUE",
sec/libsapsecu : "/sapmnt/C08/exe/libsapcrypto.so",
ssf/name : "SAPSECULIB",
ssf/ssfapi_lib : "/sapmnt/C08/exe/libsapcrypto.so",
ssl/ssl_lib : "/sapmnt/C08/exe/libsapcrypto.so",
system/type : "ABAP",
zcsa/calendar_area : "1020000",
zcsa/calendar_ids : "400",
zcsa/db_max_buftab : "80000",
zcsa/installed_languages : "123CDEFGHIKLNOPQRSTUVWXYa45689쁩",
zcsa/presentation_buffer_area : "70000000",
zcsa/system_language : "E",
zcsa/table_buffer_area : "1500000000",
ztta/dynpro_area : "900000",
ztta/parameter_area : "24000",
ztta/roll_extension : "2000000000"
}

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

In if its still open, use following:

index=equivalency sourcetype=json | spath | stats list(*) as * | transpose

View solution in original post

spyme72
Path Finder

i think i have not posted my question clearly..
inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query
my second query is
index=equivalency sourcetype=json | spath | stats list() as | transpose
which would result all the fields in the JSON.
i want to pass the fields from the first query to the second query to filter the JSON data.

0 Karma

spyme72
Path Finder

i think i have not posted my question clearly..

inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query

my second query is
index=equivalency sourcetype=json | spath | stats list(*) as *| transpose
which would result all the fields in the JSON.

i want to pass the fields from the first query to the second query to filter the JSON data.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

In if its still open, use following:

index=equivalency sourcetype=json | spath | stats list(*) as * | transpose

somesoni2
SplunkTrust
SplunkTrust

You can use following (assuming ,as per ur comment, first search give a column 'fields' which have values, name of fields, your want to display/use in second query)

inputlookup techtable| where technology= OS | fields fields|join fields[search index=equivalency sourcetype=json | spath | stats list() as *| transpose |rename column as fields]

This should give your output as 'fields'- contains only the fields present in your lookup, 'row 1' - values for those fields.

0 Karma

spyme72
Path Finder

i think i have not posted my question clearly..

inputlookup techtable| where technology= OS | fields fields would give the result of the fields i would want to use in my second query

my second query is
index=equivalency sourcetype=json | spath | stats list(*) as *| transpose
which would result all the fields in the JSON.

i want to pass the fields from the first query to the second query to filter the JSON data.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...