Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Splunk query JSON format data. (mvzip, mvindex, split)

$
0
0
Please help me! I have indexed JSON data, but I can not extract the data as I want. Below is the raw data. ##########RAW DATA########## { "username": "nsroot", "resourceName": "", "ns": [ { "network_interfaces": [ { "port_name": "LA/1" }, { "port_name": "10/2" }, { "port_name": "10/1" } ], "ip_address": "172.16.30.131", "instance_state": "Up" }, { "network_interfaces": [ { "port_name": "10/2" }, { "port_name": "LA/1" }, { "port_name": "10/1" } ], "ip_address": "172.16.30.81", "instance_state": "Up" }, { "network_interfaces": [ { "port_name": "10/1" }, { "port_name": "10/16" }, { "port_name": "LA/8" }, { "port_name": "LA/1" }, { "port_name": "10/2" }, { "port_name": "10/15" } ], "ip_address": "172.16.30.181", "instance_state": "Up" } ], "errorcode": 0, "operation": "get", "resourceType": "ns", "tenant_name": "Owner", "message": "Done" } #################### I want to make the following result from the original data, but I do not know how to write the query. Help me, Please! ![alt text][1] [1]: /storage/temp/260589-qq.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>