Hi,
I have a JSON data in following format. How can I access individual element of the array?
{ [-]
LICENSES: [ [-]
AFL and GPLv2+
AFL or GPLv2
Apache
Apache 2.0
]
}
If I write search: | table LICENSES{}
, it prints all licenses, however, I want to access an individual element as in first license or 2nd license. If I do something like table LICESNES{0}
or table LICENSES{}.{0}
etc ..nothing works. Please help.
As far as I know, Splunk extracts the Json data into fields and by default the field names get the name after its corresponding trace in the Json object.
So, in your case LICENSES is a multivalue field , so in order to access each value you could do it like this
| eval firstValue=mvIndex(LICENSES,0) | eval secondValue=mvIndex(LICENSES,1) ....
and then table the results
... | table firstValue secondValue