使用Splunk查询json数据

我们已经压缩在azure存储（表和blob）JSON格式的数据我想ETL的数据关系数据库为了有select的数据上运行的SQL查询我有一个实用工具，解压缩数据到JSON文件，I通过SSIS包通过从Excel到SQL服务器的ETL（使用数据透视将json转换为excel后）是否有更简单的方法来获得相同的目的，使用splunk？ 请注意，我的json体系结构有点复杂json的例子：

{ "columns": [ { "name": "database_name", "values": [ "sales", "salesr", "sal" ], "encd": 0, "type": 0 }, { "name": "machine_name", "values": [ "ISRVMN823", "ISRVMN825", "ISRVMN822" ], "encd": 0, "type": 0 }, { "name": "program_name", "values": [ "SQLAgent - TSQL JobStep (Job 0x8701D9C6BFB3A146B9E6AB0602F5B4C3 : Step 1)", "SQLAgent - TSQL JobStep (Job 0xE3521B34CED03441B971A36E8EF5210B : Step 1)", "SQLAgent - TSQL JobStep (Job 0x4BBA5C65C5AF78469A7FE9B765BE430E : Step 1)" ], "encd": 0, "type": 0 } ], "submission_time": 1483617753706, "ds_id": "ISRVMN889", "identity_broker": "00_yr", "connection_name": "ISRVMN822SQL2012NY", "table_name": "pass_unique_stat_5m", "version": "1.0.0", "duration": 300, "sample_time": 1483617300000 } 

我想在关系数据库中获得如下内容：

或另一种方式来查询数据

谢谢

Answer 1

干得好 ：）

你可以忽略第一部分，那就是我把数据硬编码到search中

 | makeresults | eval json = "{ \"columns\": [ { \"name\": \"database_name\", \"values\": [ \"sales\", \"salesr\", \"sal\" ], \"encd\": 0, \"type\": 0 }, { \"name\": \"machine_name\", \"values\": [ \"ISRVMN823\", \"ISRVMN825\", \"ISRVMN822\" ], \"encd\": 0, \"type\": 0 }, { \"name\": \"program_name\", \"values\": [ \"SQLAgent - TSQL JobStep (Job 0x8701D9C6BFB3A146B9E6AB0602F5B4C3 : Step 1)\", \"SQLAgent - TSQL JobStep (Job 0xE3521B34CED03441B971A36E8EF5210B : Step 1)\", \"SQLAgent - TSQL JobStep (Job 0x4BBA5C65C5AF78469A7FE9B765BE430E : Step 1)\" ], \"encd\": 0, \"type\": 0 } ], \"submission_time\": 1483617753706, \"ds_id\": \"ISRVMN889\", \"identity_broker\": \"00_yr\", \"connection_name\": \"ISRVMN822SQL2012NY\", \"table_name\": \"pass_unique_stat_5m\", \"version\": \"1.0.0\", \"duration\": 300, \"sample_time\": 1483617300000 }" | spath input=json path=columns{} | rename columns{} as cols | table cols | mvexpand cols | spath input=cols | rename values{} as values | table name values | transpose header_field=name | fields - column