The answers here were not helping me. The expanded examples in the spath doc were helpful, but as an exercise I wanted to work through this. SO came up with this that seems to be what you want:
| makeresults
| eval _raw="{
\"id\":\"123412341234\",
\"actions\": [
{
\"type\":\"a\",
\"status\":\"b\",
\"amount\": 1,
\"time_updated\": \"2013-10-14T11:00\"
},
{
\"type\":\"c\",
\"status\":\"d\",
\"amount\": 1,
\"time_updated\": \"2013-10-14T12:00\"
}
]
}"
| spath
| rename "actions{}.type" AS type
| rename "actions{}.status" AS status
| rename "actions{}.time_updated" AS time_updated
| rename "actions{}.amount" AS amount
| eval zipped=mvzip( time_updated, mvzip( type, mvzip( status, amount ) ))
| mvexpand zipped
| eval zipped=split( zipped, "," )
| eval time_updated=mvindex( zipped, 0 )
| eval type=mvindex( zipped, 1 )
| eval status=mvindex( zipped, 2 )
| eval amount=mvindex( zipped, 3 )
| table time_updated, id, type, status, amount
Cheers.
... View more