fieldnamesFromJson

Extract all first level keys from JSON objects in a column.

The jsonToColumns operator extracts all keys in the JSON object into separate columns. Later in a playbook you might be doing some processing on those columns. In a different batch this playbook might fail, because jsonToColumns produces columns from JSON dynamically, and it is not guaranteed that all keys existed in the previous batch will be present in the current batch. If the playbook depends on some columns that are not present in the output of jsonToColumns operator, the playbook will fail to execute.

This operator allows you to extract all possible keys from the JSON object and use the output as a defaultFields argument in the jsonToColumns operator.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter Field Names from JSON operator in the search field and select the operator from the Results to open the operator form.
3. In the Input Table drop-down, enter or select the table containing the data to run this operator on.
4. In the JSON field, enter or select a column from the drop-down that contains the JSON object.
5. Click Run to view the result.
6. Click Save to add the operator to the playbook.
7. Click Cancel to discard the operator form.

Usage Details

LQL Command

fieldnamesFromJson(input_table, "jsonField")

Input

table: Table name to apply operator.
jsonField: Field name that contains the JSON object.

Example

Input

Output

LQL command

fieldnamesFromJson(input_table, "_raw") -- produces"a, b, c, d" output