将嵌套的 JSON 数组解析为 Splunk 表答案

【问题标题】：Parse Nested JSON Array into Splunk Table将嵌套的 JSON 数组解析为 Splunk 表
【发布时间】：2019-08-02 02:03:09
【问题描述】：

我在 splunk 中有以下带有嵌套数组的 JSON 事件 -:

{
"items":
    [
        {
            "parts":
                [
                    {
                        "code":"1","var":"","pNum":"101","counter":1019
                    },
                    {
                        "code":"0","var":"","pNum":"102","counter":1029
                    }
                ],
            "se":"A1",
            "so":"111"
        },
        {
            "parts":
                [
                    {
                        "code":"1","var":"","pNum":"301","counter":3019
                    },
                    {
                        "code":"0","var":"","pNum":"302","counter":3029
                    }
                ],
            "se":"A3",
            "so":"333"
        },
        {
            "parts":
                [
                    {
                        "code":"0","var":"","pNum":"401","counter":4019
                    }
                ],
            "se":"A4",
            "so":"444"
        },
        {
            "parts":
                [
                    {
                        "code":"1","var":"","pNum":"501","counter":5019
                    }
                ],
            "se":"A5",
            "so":"555"
        }
    ],
"id":"x.9110790",
"cr":"x-273169"
}

我想将此 JSON 提取到下面的 Splunk 表中 -：

我尝试使用 spath 如下，但它只给出下面给出的错误结果 -:

|制造商结果 |评估 _raw="{ \“项目\”： [ { \“部分\”： [ { \"code\":\"1\",\"var\":\"\",\"pNum\":\"101\",\"counter\":1019 }, { \"code\":\"0\",\"var\":\"\",\"pNum\":\"102\",\"counter\":1029 } ], \"se\":\"A1\", \"所以\":\"111\" }, { \“部分\”： [ { \"code\":\"1\",\"var\":\"\",\"pNum\":\"301\",\"counter\":3019 }, { \"code\":\"0\",\"var\":\"\",\"pNum\":\"302\",\"counter\":3029 } ], \"se\":\"A3\", \"所以\":\"333\" }, { \“部分\”： [ { \"code\":\"0\",\"var\":\"\",\"pNum\":\"401\",\"counter\":4019 } ], \"se\":\"A4\", \"所以\":\"444\" }, { \“部分\”： [ { \"code\":\"1\",\"var\":\"\",\"pNum\":\"501\",\"counter\":5019 } ], \"se\":\"A5\", \"所以\":\"555\" } ], \"id\":\"x.9110790\", \"cr\":\"x-273169\" }" |spath |rename items as * | table id, cr,items{}.*

我第一次尝试解析 JSON 类型的 splunk 日志。因此，请提供解决此问题的任何提示。谢谢

【问题讨论】：

标签： json splunk multivalue splunk-query

【解决方案1】：

@克里普兹

你能试试这个搜索吗？

|制造结果| eval _raw="{ \"items\": [ { \"parts\": [ { \"code\":\"1\",\"var\":\"\",\"pNum\":\"101\",\"counter\":1019 }, { \"code\":\"0\",\"var\":\"\",\"pNum\":\"102\",\"counter\":1029 } ], \"se\":\"A1\", \"so\":\"111\" }, { \"parts\": [ { \"code\":\"1\",\"var\":\"\",\"pNum\":\"301\",\"counter\":3019 }, { \"code\":\"0\",\"var\":\"\",\"pNum\":\"302\",\"counter\":3029 } ], \"se\":\"A3\", \"so\":\"333\" }, { \"parts\": [ { \"code\":\"0\",\"var\":\"\",\"pNum\":\"401\",\"counter\":4019 } ], \"se\":\"A4\", \"so\":\"444\" }, { \"parts\": [ { \"code\":\"1\",\"var\":\"\",\"pNum\":\"501\",\"counter\":5019 } ], \"se\":\"A5\", \"so\":\"555\" } ], \"id\":\"x.9110790\", \"cr\":\"x-273169\" }" |kv | spath path=items{} output=items | mv展开项目 |字段 cr id 项目 |评估 raw=items |千伏 |改名部分{}.* 作为部分* |评估 temp=mvzip(mvzip(Parts_code,Parts_counter),Parts_pNum) | mvexpand temp | eval Parts_code=mvindex(split(temp,","),0) ,Parts_counter=mvindex(split(temp,","),1),Parts_pNum=mvindex(split(temp,","),2) | table id cr se so Parts_code Parts_var Parts_counter Parts_pNum

查看我的博客是否相同：https://www.crestdatasys.com/blogs/how-to-extract-complex-field-from-nested-json-events-using-splunk-spl/

【讨论】：