![]() You can use this function with the eval and where commands, in the WHERE clause of the from command, and as part of evaluation expressions with other commands. A can be a string, number, Boolean, null, multivalue field, array, or another JSON object. If you specify a string for a or, you must enclose the string in double quotation marks. In addition, there are multivalue and conversion functions that create JSON arrays or objects: mv_to_json_array andĬreates a new JSON object from members of key-value pairs. Generate or overwrite a JSON object using the key-value pairs specified.Įvaluate whether a JSON object uses valid JSON syntax and returns either TRUE or FALSE. Insert or overwrite values for a JSON node with the values provided and return an updated JSON object. Return the keys from the key-value pairs in a JSON object. Return Splunk software native type values from a piece of JSON by matching literal strings in the event and extracting the strings as keys. Return either a JSON array or a Splunk software native type value from a field and zero or more paths. Map the elements of a JSON array to a multivalued field.Įxtend the contents of a valid JSON object with the values of an array. The following table describes the functions that are available for you to use to create or manipulate JSON objects:Ĭreate a new JSON object from key-value pairs.Īppend elements to the contents of a valid JSON object.Ĭreate a JSON array using a list of values.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |