Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Splunk table with nested JSON - print parent item with each child item

$
0
0
I'm a newbie and I know this should be super easy, but I can't create a table with separate rows (events) for each combination of project name + task. Given the JSON below, I'm trying to create a table with each task in each project -- so I should have 4 entries. Instead, I'm getting the 2 projects each with 1 task (screenshot attached). Strangely, I got this example from another forum post where people seemed to believe it was behaving correctly. Here's what I want: ProjectName TaskName Build Computer Order Hardware Build Computer Install Software Submit Timesheet Fill out Timesheet Submit Timesheet Email Timesheet **Orig Json** { "FirstName": "John", "LastName": "Doe", "Projects": [ { "ProjectName": "Build Computer", "Tasks": [ { "TaskName": "Order hardware", "TaskDueDate": "1/1/2018" }, { "TaskName": "Install software", "TaskDueDate": "1/2/2018" } ] }, { "ProjectName": "Submit Timesheet", "Tasks": [ { "TaskName": "Fill out Timesheet", "TaskDueDate": "2/1/2018" }, { "TaskName": "Email Timesheet", "TaskDueDate": "2/2/2018" } ] } ] } **Here's the "answer" from the original post:** | makeresults | eval _raw="{\"FirstName\":\"John\",\"LastName\":\"Doe\",\"Projects\":[{\"ProjectName\":\"Build Computer\",\"Tasks\":[{\"TaskName\":\"Order hardware\",\"TaskDueDate\":\"1/1/2018\"},{\"TaskName\":\"Install software\",\"TaskDueDate\":\"1/2/2018\"}]},{\"ProjectName\":\"Submit Timesheet\",\"Tasks\":[{\"TaskName\":\"Fill out Timesheet\",\"TaskDueDate\":\"2/1/2018\"},{\"TaskName\":\"Email Timesheet\",\"TaskDueDate\":\"2/2/2018\"}]}]}" | spath |rename Projects{}.Tasks{}.TaskDueDate AS x, Projects{}.ProjectName AS y, Projects{}.Tasks{}.TaskName AS z | eval joinfield = mvzip(x,mvzip(y,z)) |mvexpand joinfield |eval Name=mvindex(FirstName,0) +" "+mvindex(LastName,0) | eval spjoinfield = split(joinfield,",") | eval Date=mvindex(spjoinfield ,0) | eval ProjectName=mvindex(spjoinfield ,1)| eval TaskName=mvindex(spjoinfield ,2)|table Name ProjectName TaskName Date ^which returns the wrong answer (but closer than I was getting with spath): Build Computer Order Hardware Submit Timesheet Install Software

Viewing all articles
Browse latest Browse all 47296

Trending Articles