the following seach string basically pulls out the JSON puts it in a variable called data and then runs it through spath. I then output two elements from the json. What I get is a couple of multivalue fields but the second table shows what I want.
index=fulfillment com.x.y.u.i.segment.SegmentJoinDataWorkflow category | rex ".*SegmentJoinDataWorkflow: (?.*)" | spath input=data | rename segments{}.customSegmentName AS customSegmentName, segments{}.expression{}.$and{}.$and{}.$or{}.category as category | table _time,customSegmentName,category
2014-11-13 14:42:56 Test117182801LVRPublSD2Adv 5256
Test117182802LVRPublSD2Adv 5257
5987
5000
5256
5257
5987
5000
2nd table Basically taking the json tree structure and flatten it out into multiple events
Any help on how to do this would be appreciated. I have tried a number of things with the mv[commands] mvexpand,mvzip, mvappend, makemv etc..
2014-11-13 14:42:56 Test117182801LVRPublSD2Adv 5256
2014-11-13 14:42:56 Test117182801LVRPublSD2Adv 5257
2014-11-13 14:42:56 Test117182801LVRPublSD2Adv 5987
2014-11-13 14:42:56 Test117182801LVRPublSD2Adv 5000
**2014-11-13 14:42:56 Test117182802LVRPublSD2Adv 5256
2014-11-13 14:42:56 Test117182802LVRPublSD2Adv 5257
2014-11-13 14:42:56 Test117182802LVRPublSD2Adv 5987
2014-11-13 14:42:56 Test117182802LVRPublSD2Adv 5000**
My JSON:
{ "accountInfo" : { "policyType" : "basic",
"shareAccountId" : "1063216919"
},
"adId" : "40283453",
"isRequired" : "true",
"manualApproval" : [ "no" ],
"notification" : { "DATALOADER" : { "failureUrl" : "http://batch/status/",
"successUrl" : "http://status/"
},
"EMAIL" : { "email" : [ "" ] }
},
"notifyUser" : [ "onAll" ],
"packageId" : "1171824434543",
"packageName" : "Test11718244DataApp",
"PartnerId" : "5034534",
"segments" : [ { "id_count" : 112,
"controlPercent" : 20,
"count" : "123",
"customSegmentId" : "1171824401",
"customSegmentName" : "Test1171824401Dataloader",
"expression" : [ { "$and" : [ { "$and" : [ { "$or" : [ { "category" : "5256" },
{ "category" : "5257" }
] } ] },
{ "$and" : [ { "$or" : [ { "category" : "5987" },
{ "category" : "5000" }
] } ] }
] } ],
"locations" : [ "" ],
"total_ashid_count" : 100
},
{ "id_count" : 112,
"controlPercent" : 20,
"count" : "123",
"customSegmentId" : "1171824402",
"customSegmentName" : "Test1171824402Dataloader",
"expression" : [ { "$and" : [ { "$and" : [ { "$or" : [ { "category" : "5256" },
{ "category" : "5257" }
] } ] },
{ "$and" : [ { "$or" : [ { "category" : "5987" },
{ "category" : "5000" }
] } ] }
] } ],
"locations" : [ "" ],
"total_id_count" : 100
}
],
"username" : "",
}
... View more