Description
Converts a string data type into json data type, which is required as an argument for the Jq evaluation (jqeval) operation.
How does it work in the search window?
Select Create field in the search window toolbar, then select the To json operation. You need to specify one argument:
Argument | Data type | Description |
|---|---|---|
String to convert mandatory | string | The full sample with json syntax. You can manually enter the string or select a field with json data type. For a successful extraction using it as an argument in the Jq evaluation (jqeval) operation, it must contain valid json syntax. |
The data type of the values in the new field is json.
Example
In this example, in the siem.logtrust.web.activity table, we will manually specify a string to create a json field, which can be later used as an argument in the Jq evaluation (jqeval) operation.
Click the Create field button on the toolbar, select the To json (jsonparse) operation and give the new field a name.
Add the necessary argument and configure it as shown in the picture below:
string to convert → manually introduced → {"name":"John","birth":"1986-12-14","city":"New York"}
.png?version=1&modificationDate=1683797022863&cacheVersion=1&api=v2&width=226&height=261)
Click Create field and a new field will be created with the specified string in json data type.
.png?version=1&modificationDate=1683797033506&cacheVersion=1&api=v2&width=340&height=173)
Now you have your new field ready to use as an argument in the Jq evaluation (jqeval) operation.
How does it work in LINQ?
Be aware that json syntax is expressed differently in LINQ. This is because some characters must be included for the json syntax to be recognized as a whole unit and as a set of individual parts at the same time. One of the examples is the backslash (\), an escape character used to bypass the closing double quotes (") that mark the end of a string, enabling you to extend it up to the desired point.
Use the operator select... as... and add the operation syntax to create the new field. This is the syntax for the To json operation:
jsonparse(string)
Example
You can use the following LINQ script to recreate the example above in any table (for example, in siem.logtrust.web.activity):
from siem.logtrust.web.activity
select jsonparse("{ \"name\":\"John\", \"birth\":\"1986-12-14\", \"city\":\"New York\"}") as Json