I have a json structure that contains an object map:
{
"correlation_id": "f9535d13-f75b-4dd7-8c39-1e77b1559afe",
"targeting_data": [
{
"attribute_values": {
"1013": "005",
"2056": "07",
"2057": "01",
"2058": "03",
"2060": "02",
"2065": "01",
"2075": "04",
"2080": "03",
"2081": "01",
"DMA": "803",
"RECTYPE": "HD",
"RECVCNT": "6",
"STATE": "CA",
"SVCPKGTIER": "5"
},
"origin": null
}
],
"timestamp": "2020-06-02T00:02:09.257+00:00",
"zone_target_area": "195"
}
How do i take the fields extracted as targeting_data{}.attribute_values.1013, targeting_data{}.attribute_values.2056 and output the field names (1013, 2056) as values. I would like for my output to be a list of the map's keys.
@vasugazula
Can you please try this? You will have your values in map_s_keys
field.
YOUR_SEARCH | eval map_s_keys=""
| foreach targeting_data{}.attribute_values.* [ eval map_s_keys=if(map_s_keys="","<<MATCHSTR>>", map_s_keys.","."<<MATCHSTR>>") ] | table map_s_keys
Sample Search:
| makeresults | eval _raw="{\"correlation_id\": \"f9535d13-f75b-4dd7-8c39-1e77b1559afe\",\"targeting_data\": [{\"attribute_values\": {\"1013\": \"005\",\"2056\": \"07\",\"2057\": \"01\",\"2058\": \"03\",\"2060\": \"02\",\"2065\": \"01\",\"2075\": \"04\",\"2080\": \"03\",\"2081\": \"01\",\"DMA\": \"803\",\"RECTYPE\": \"HD\",\"RECVCNT\": \"6\",\"STATE\": \"CA\",\"SVCPKGTIER\": \"5\"},\"origin\": null}],\"timestamp\": \"2020-06-02T00:02:09.257+00:00\",\"zone_target_area\": \"195\"}" | extract | eval map_s_keys=""
| foreach targeting_data{}.attribute_values.* [ eval map_s_keys=if(map_s_keys="","<<MATCHSTR>>", map_s_keys.","."<<MATCHSTR>>") ] | table map_s_keys
Thanks