Splunk® Cloud Services

SPL2 Search Reference

flatten command overview

Use the SPL2 flatten command on an object to convert the key-value pairs in the object into separate fields in an event. The flatten command can flatten only the first level of an object, see flatten command usage.


The required syntax is in bold.

flatten <object>

How the SPL2 flatten command works

The following object contains information about the Tower Bridge in London, England:

{name: "Tower Bridge", length: 801}

You use the SPL2 flatten command to create separate fields from the key-value pairs in the object.

Consider the following search:

| FROM [{}] SELECT _time, {name: "Tower Bridge", length: 801} as bridges, "London" AS City, "England" AS Country | flatten bridges

  • Using an empty dataset literal with the from command produces a timestamp in the _time field.
  • You specify expressions with the SELECT clause of the from command. The expressions can include the following elements:
    • Objects like {name: "Tower Bridge", length: 801}
    • Values with named fields like "London" AS City
    • Arrays of objects

The results look like this:

_time City Country bridges length name
08 Mar 2022 3:43:48.000 PM London England {"name":"Tower Bridge","length":801} 801 Tower Bridge

The order of the field names in the output is lexicographical, which is alphabetical and case-sensitive. Internal fields come first, followed by uppercase letters, and finishing with lowercase letters. If you had named the field city instead of City, the city field would appear after the bridges field in the results.

To learn more about lexicographical order, see Lexicographical order in the SPL2 Search Manual.

You can use the flatten command with arrays of objects as well single objects. For additional examples, see flatten command examples.

See also

flatten command
flatten command syntax details
flatten command usage
flatten command examples
Last modified on 31 January, 2024
fieldsummary command examples   flatten command syntax details

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters