I have a json array like:
How can I search or split that? The search:
index=jira "issues{}.fields.customfield_14028"=521 | head 1 | stats sum("issues{}.fields.customfield_14233") by "issues{}.fields.summary"
gives all issues....also where issues{}.fields.customfield_14028"<>521
is it possible to extract a field from a result contained in a JSON field?
Ex; result of field payment.log: {"data":{"lancto_dto_list":,"sld_dt":{"lim":10.00,"sld_disp":37.80,"disp":40.80}}}
I need the last field "disp".
| makeresults
| eval _raw="payment.log: {\"data\":{\"lancto_dto_list\":,\"sld_dt\":{\"lim\":10.00,\"sld_disp\":37.80,\"disp\":40.80}}}"
| rex "disp.:(?<disp>[\d.]+)"
Found it after some test and thanks to https://answers.splunk.com/answers/366957/how-do-i-get-splunk-to-extract-nested-json-arrays.html
index=jira | head 1 | spath output=x path=issues{} | fields - _raw | fields x | mvexpand x | spath input=x | rename fields{} as fields | mvexpand fields | search fields.customfield_14028=521 | table key,fields.summary,fields.customfield_12931.value,fields.customfield_12927,fields.customfield_14233,fields.customfield_12932.value,price
Give a nice table for all "events" where fields.customfield_14028=521
Hi @moseisleydk,
Can you please try this search?
index=jira "issues{}.fields.customfield_14028"=521
| head 1
| rename "issues{}.fields.customfield_14233" as customfield_14233, "issues{}.fields.summary" as summary
| eval tempField=mvzip(customfield_14233,summary)
| stats count by _time,tempField
| eval customfield_14233=mvindex(split(tempField,","),0), summary=mvindex(split(tempField,","),1)
| stats sum(customfield_14233) by summary
Thanks
Hi,
Thanks, it still "ignores" the
"issues{}.fields.customfield_14028"=521
and reports all issues, not only the
customfield_14028: 521
issues.
Kind Regards,
Normann
Can you please share sample events? use 101010
for same.