Page Comparison

Description

Returns the data type of the value inside a JSON object. Note that you must first extract the value from the JSON using the Jq evaluation (jqeval) operation. This operation is helpful when you want to convert the data type of the extracted value and you need to know which one is appropriate.

Alternatively, you can quickly check the data types and transform them, even without previously extracting them, using the pretty-print view (more info in the article Working with JSON objects in data tables).

How does it work in the search window?

Select Create field in the search window toolbar, then select the Json value type operation. You need to specify one argument:

The data type of the values in the new field is string.

Example 1

In this example, in the demosiem.logtrust.ecommerceweb.dataactivity table, we will perform the To json (jsonparse) operation to obtain the JSON below (1) and the Jq evaluation (jqeval) operation to extract one value from it (2):

...

Example 2

In this example, in the demosiem.logtrust.ecommerceweb.dataactivity table, we will perform the To json (jsonparse) operation to obtain the JSON below (1) and the Jq evaluation (jqeval) operation to extract each value in a different field (2):

...

Use the operator select... as...  and add the operation syntax to create the new field. This is the syntax for the Json value type operation:

• label(json_value)

Example 1

You can use the following LINQ script to recreate example 1 in any table (for example, in demosiem.logtrust.ecommerceweb.dataactivity):

from demosiem.logtrust.ecommerceweb.dataactivity
select jsonparse("{ \"name\":\"John\", \"birth\":\"1986-12-14\", \"city\":\"New York\"}") as Json
select jqeval(jqcompile(".city"), Json) as City
select label(City) as CityLabel

Example 2

You can use the following LINQ script to recreate example 2 in any table (for example, in demosiem.logtrust.ecommerceweb.dataactivity):

from demo.ecommerce.datasiem.logtrust.web.activitysiem.logtrust.web.activitysiem.logtrust.web.activitysiem.logtrust.web.activitysiem.logtrust.web.activitysiem.logtrust.web.activity
select jsonparse("{\"str\": \"hola\", \"int\": 1, \"float\": 2.5, \"boolean\": true, \"array\": [1,2,3], \"object\": {\"a\": 5}}") as json
select jqeval(jqcompile(".str"), json) as jsonStr,
jqeval(jqcompile(".int"), json) as jsonInt,
jqeval(jqcompile(".float"), json) as jsonFloat,
jqeval(jqcompile(".boolean"), json) as jsonBoolean,
jqeval(jqcompile(".array"), json) as jsonArray,
jqeval(jqcompile(".object"), json) as jsonObject
select label(jsonStr) as labelStr,
label(jsonInt) as labelInt,
label(jsonFloat) as labelFloat,
label(jsonBoolean) as labelBoolean,
label(jsonArray) as labelArray,
label(jsonObject) as labelObject