Hello everyone,
I search a very longtime on internet and splunk doc and i didn't get what i want well i have this Json array :
"LeagueResult": {
"Matchs":
{
"Team": "MANU",
"Date": "2017-09-25T00:00:00",
"Place": "HOM",
"Scored": 0,
"Conceded": 4,
"Difference": -4,
},
{
"Team": "CHE",
"Date": "2017-10-05T00:00:00",
"Place": "AWA",
"Scored": 5,
"Conceded": 4,
"Difference": 1,
},
...
{
"Team": "TOT",
"Date": "2017-10-05T00:00:00",
"Place": "HOM",
"Scored": 1,
"Conceded": 1,
"Difference": 0,
}
And I want to obtain this table or a look-like one :
I used spath function, mvzip function and mvexpand but I didn't succeed.
@OualidAn, your sample JSON seems to be incorrect each node inside LeagueResults should start with section like Matches in your first subset. Following is a run anywhere search based on your data. PS: first two pipes makeresults and eval generate the mock data, you would not require them with your actual data, provided JSON is formatted correctly.
| makeresults
| eval _raw="{
\"LeagueResult\": {
\"Matchs\": {
\"Team\": \"MANU\",
\"Date\": \"2017-09-25T00:00:00\",
\"Place\": \"HOM\",
\"Scored\": 0,
\"Conceded\": 4,
\"Difference\": -4
},
\"Matchs\": {
\"Team\": \"CHE\",
\"Date\": \"2017-10-05T00:00:00\",
\"Place\": \"AWA\",
\"Scored\": 5,
\"Conceded\": 4,
\"Difference\": 1
},
\"Matchs\": {
\"Team\": \"TOT\",
\"Date\": \"2017-10-05T00:00:00\",
\"Place\": \"HOM\",
\"Scored\": 1,
\"Conceded\": 1,
\"Difference\": 0
}
}
}"
| spath
| fields - _raw _time
| rename LeagueResult.Matchs.* as *
| eval data=mvzip(mvzip(mvzip(mvzip(Place,Team),Conceded),Scored),Difference)
| fields data
| mvexpand data
| makemv data delim=","
| eval Place=mvindex(data,0)
| eval Team=mvindex(data,1)
| eval Conceded=mvindex(data,2)
| eval Scored=mvindex(data,3)
| eval Difference=mvindex(data,4)
| table Place Team Scored Conceded Difference
Refer to Splunk documentation on details for working with Multivalue fields:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Parsemultivaluefields
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/MultivalueEvalFunctions
@OualidAn, your sample JSON seems to be incorrect each node inside LeagueResults should start with section like Matches in your first subset. Following is a run anywhere search based on your data. PS: first two pipes makeresults and eval generate the mock data, you would not require them with your actual data, provided JSON is formatted correctly.
| makeresults
| eval _raw="{
\"LeagueResult\": {
\"Matchs\": {
\"Team\": \"MANU\",
\"Date\": \"2017-09-25T00:00:00\",
\"Place\": \"HOM\",
\"Scored\": 0,
\"Conceded\": 4,
\"Difference\": -4
},
\"Matchs\": {
\"Team\": \"CHE\",
\"Date\": \"2017-10-05T00:00:00\",
\"Place\": \"AWA\",
\"Scored\": 5,
\"Conceded\": 4,
\"Difference\": 1
},
\"Matchs\": {
\"Team\": \"TOT\",
\"Date\": \"2017-10-05T00:00:00\",
\"Place\": \"HOM\",
\"Scored\": 1,
\"Conceded\": 1,
\"Difference\": 0
}
}
}"
| spath
| fields - _raw _time
| rename LeagueResult.Matchs.* as *
| eval data=mvzip(mvzip(mvzip(mvzip(Place,Team),Conceded),Scored),Difference)
| fields data
| mvexpand data
| makemv data delim=","
| eval Place=mvindex(data,0)
| eval Team=mvindex(data,1)
| eval Conceded=mvindex(data,2)
| eval Scored=mvindex(data,3)
| eval Difference=mvindex(data,4)
| table Place Team Scored Conceded Difference
Refer to Splunk documentation on details for working with Multivalue fields:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Parsemultivaluefields
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/MultivalueEvalFunctions
thank you that what i was looking for, it works perfectly now !