Warning: Long, detailed explanation ahead. 🙂 Summary version is that I have a nested json arrays and fields that I am having an issue with extracting properly into individual fields. The chosen fields will change over time, based on external factors so I need to be able to extract and report on all of them, with the ability to identify the array index (i.e. {0}, or {1}, etc). No solution that I have looked at or come up with is working for me, so I am turning to you smarter folks to help. Detail: I have a nested json arrays and fields that I am having an issue with extracting properly into individual fields. The end result is that I want to be able to place alerts or report on various fields that are deemed interesting. These are "request" and "response" arrays in each transaction (think checking items in a shopping cart for various flag and indicators). The chosen fields will change over time, based on external factors so I need to be able to extract them from the array and report on all of them at some point. Here is a sample request and response As you can see the the request array is market_basket.request{} and the response is market_basket.response{}. Focusing on the response portion, the first response has an "02" field and a "dataset". The next response{1} has fields 02,03,04,05,08,etc etc., same with response{2} and response{3} if I do a simple rename | rename market_basket.response.* to Resp_* the fields don't line up. The contents of "Resp_19" should be down 1 line as there was no field 19 in market_basket.response{0}. See here: If I change the query to this | spath path=market_basket.response{} output=Response
| spath input=Response
| table tran_id 0* 1* 2* dataset Then I only get the first row, the other 3 rows don't show up. The only way that I have been able to get it to work is to address each indices and field individually | spath path=market_basket.response{0} output=Resp_0
| spath path=market_basket.response{0}.dataset output=Resp_0_dataset
| spath path=market_basket.response{0}.02 output=Resp_0_02
| spath path=market_basket.response{1} output=Resp_1
| spath path=market_basket.response{1}.dataset output=Resp_1_dataset
| spath path=market_basket.response{1}.01 output=Resp_1_01
| spath path=market_basket.response{1}.02 output=Resp_1_02
| spath path=market_basket.response{1}.03 output=Resp_1_03
| spath path=market_basket.response{1}.04 output=Resp_1_04
| spath path=market_basket.response{1}.05 output=Resp_1_05
| spath path=market_basket.response{1}.06 output=Resp_1_06
| spath path=market_basket.response{1}.07 output=Resp_1_07
| spath path=market_basket.response{1}.08 output=Resp_1_08
| spath path=market_basket.response{1}.09 output=Resp_1_09
| spath path=market_basket.response{1}.10 output=Resp_1_10
| spath path=market_basket.response{1}.11 output=Resp_1_11
| spath path=market_basket.response{1}.12 output=Resp_1_12
| spath path=market_basket.response{1}.13 output=Resp_1_13
| spath path=market_basket.response{1}.14 output=Resp_1_14
| spath path=market_basket.response{1}.15 output=Resp_1_15
| spath path=market_basket.response{1}.16 output=Resp_1_16
| spath path=market_basket.response{1}.17 output=Resp_1_17
| spath path=market_basket.response{1}.18 output=Resp_1_18
| spath path=market_basket.response{1}.19 output=Resp_1_19
| spath path=market_basket.response{1}.20 output=Resp_1_20
| spath path=market_basket.response{1}.21 output=Resp_1_21
... But with up to 60 responses with 20 fields per transaction, that many spaths would be a non-starter. Especially considering that I need to factor in the request portions too at some point. Finally, to give an example use case, I want to be able to check field 19 on the response and if the flag starts with "NN" or "NY", then put out an alert: "Item".market_basket{whatever #}.02." has been not been cleared for sale". Flags are:".market_basket{whatever #].19 I know that was a lot of detail, but I wanted to make sure that I put down the different ways that I tried. Any help would be much appreciated!
... View more