I need help in extracting fields from the dynamically nested array coordinates from JSON.
Here is the example data.
thirdParty: { [-]
Adobe Analytics: { [-]
bytes: 3182
end_time: 1726
requests: 4
serial_time: 212
start_time: 773
total_user_time: 953
}
Adobe TypeKit: { [-]
bytes: 162558
end_time: 895
requests: 4
serial_time: 38
start_time: 446
total_user_time: 449
}
Cloudfront: { [-]
bytes: 21578
end_time: 2241
requests: 1
serial_time: 26
start_time: 2215
total_user_time: 26
}
The number of arrays within the ThirdParty array is dynamic. And I need to create a table like this.
Site total_user_time
Adobe Analytics 953
Adobe TypeKit 449
Cloudfront 26
@aravindhan_padmanabhan
Can you please try below search?
YOUR_SEARCH | spath thirdParty output=_raw | kv | fields *.total_user_time, | fields - thirdParty.* _raw, _time | rename *.total_user_time as * | transpose column_name=Site | rename "row 1" as total_user_time
My Sample Search:
| makeresults | eval _raw="{\"thirdParty\": {\"Adobe Analytics\": {\"bytes\": \"3182\",\"end_time\": \"1726\",\"requests\": \"4\",\"serial_time\": \"212\",\"start_time\": \"773\",\"total_user_time\": \"953\"},\"Adobe TypeKit\": {\"bytes\": \"162558\",\"end_time\": \"895\",\"requests\": \"4\",\"serial_time\": \"38\",\"start_time\": \"446\",\"total_user_time\": \"449\"},\"Cloudfront\": {\"bytes\": \"21578\",\"end_time\": \"2241\",\"requests\": \"1\",\"serial_time\": \"26\",\"start_time\": \"2215\",\"total_user_time\": \"26\"}}}" | kv | spath thirdParty output=_raw | kv | fields *.total_user_time, | fields - thirdParty.* _raw, _time
| rename *.total_user_time as * | transpose column_name=Site | rename "row 1" as total_user_time
Thanks