08-21-2024 10:53 PM
I've got json like below and trying to extract each key_name via json_extract_array but getting empty column vendor
query is
dataset = host_inventory
| fields application as aps
| alter vendor = json_extract_array(to_json_string(aps),"$.key_name")
[
{
"identifier": null,
"install_date": "2021-01-12",
"installed_for_sid": "global",
"is_from_appstore": null,
"key_name": "{DB1CD517-ED68-464C-A797-7C3D29B3CB27}",
"manager_name": "windows",
"application_name": "VNC Server 6.7.2",
"raw_version": "6.7.2.42622",
"uninstall_string": "MsiExec.exe /I{DB1CD517-ED68-464C-A797-7C3D29B3CB27}",
"url_info_about": "https://www.realvnc.com",
"url_update_info": "",
"vendor": "RealVNC Ltd",
"version": "6.7.2.42622",
"win_installer": true
},
{
"identifier": null,
"install_date": "2024-08-14",
"installed_for_sid": "global",
"is_from_appstore": null,
"key_name": "{EAD0DD81-531A-4ECA-84DB-87BDB40B15DA}",
"manager_name": "windows",
"application_name": "Cortex XDR 8.4.1.53273",
"raw_version": "8.4.1.53273",
"uninstall_string": "MsiExec.exe /X{EAD0DD81-531A-4ECA-84DB-87BDB40B15DA}",
"url_info_about": "",
"url_update_info": "",
"vendor": "Palo Alto Networks, Inc.",
"version": "8.4.1.53273",
"win_installer": true
}
]
