Then it maps that array into a multivalue field named my_little_ponies with the values Buttercup, Fluttershy, and Rarity. This example demonstrates usage of the json_array_to_mv function to create multivalue fields out of JSON data.Ĭreate a simple multivalue field The following example creates a simple array. There is also a function that maps multivalue fields to JSON arrays. When set to true(), the json_array_to_mv function preserves bracketing quotes on JSON string data types when it converts an array into a multivalue field. The input defaults to false().īy default (or when you explicitly set it to false()), the json_array_to_mv function removes bracketing quotes from JSON string data types when it converts an array into a multivalue field. Use the input to specify that the json_array_to_mv function should preserve bracketing quotes on JSON-formatted strings. If the input to the function is not a valid JSON array, the function outputs nothing. You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. This function maps the elements of a proper JSON array into a multivalue field. Create a basic JSON object The following example creates a basic JSON object " ]. These examples show different ways to use the json_object function to create JSON objects in your events.ġ. A can be a string, number, Boolean, null, multivalue field, array, or another JSON object. If you specify a string for a or, you must enclose the string in double quotation marks. In addition, there are multivalue and conversion functions that create JSON arrays or objects: mv_to_json_array andĬreates a new JSON object from members of key-value pairs. ![]() Generates or overwrites a JSON object using the key-value pairs specified.Įvaluates whether a JSON object uses valid JSON syntax and returns either TRUE or FALSE. Inserts or overwrites values for a JSON node with the values provided and return an updated JSON object. Returns the keys from the key-value pairs in a JSON object. ![]() Returns Splunk software native type values from a piece of JSON by matching literal strings in the event and extracting the strings as keys. ![]() Returns either a JSON array or a Splunk software native type value from a field and zero or more paths. Maps the elements of a JSON array to a multivalued field.Įxtends the contents of a valid JSON object with the values of an array. The following table describes the functions that are available for you to use to create or manipulate JSON objects:Ĭreates a new JSON object from key-value pairs.Īppends elements to the contents of a valid JSON object.Ĭreates a JSON array using a list of values.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |