Jq evaluation (jqeval)
Uses the jq JSON processor to identify and extract a single value from a JSON object contained in another column.
How does it work in the search window?
Select Create column in the search window toolbar, then select the Jq evaluation operation. You need to specify one argument:
The data type of the values in the new column is json.
We want to extract the email value from a simple JSON object contained in the json column. Hover over the json column and hit the P key on your keyboard to open the JSON object in pretty-print. Now click the email line in the pretty-print and the Operations Over Columns window opens to the Create Column tab. The Jq eval operation is automatically selected along with the correct jq filter for the email value and json column name as arguments. All you need to do is enter an appropriate Column Name and click Create Column.
The new column will contain the email value for each event's JSON object.
How does it work in LINQ?
Use the operator
as... and add the operation syntax to create the new column. This is the syntax for the Jq evaluation operation:
The LINQ query corresponding to the above example is:
To extract the email value as string data type, you can apply the To string (str) operation to the entire operation:
For more information about specifying jq filters, see the jq online manual.