flatten command overview

Use the SPL2 flatten command on an object to convert the key-value pairs in the object into separate fields in an event. The flatten command can flatten only the first level of an object, see flatten command usage.

Syntax

The required syntax is in bold.

flatten <object>

How the SPL2 flatten command works

The following object contains information about the Tower Bridge in London, England:

{name: "Tower Bridge", length: 801}

You use the SPL2 flatten command to create separate fields from the key-value pairs in the object.

Consider the following search:

| FROM [{}] SELECT _time, {name: "Tower Bridge", length: 801} as bridges, "London" AS City, "England" AS Country | flatten bridges

• Using an empty dataset literal with the from command produces a timestamp in the _time field.
• You specify expressions with the SELECT clause of the from command. The expressions can include the following elements:
  • Objects like {name: "Tower Bridge", length: 801}
  • Values with named fields like "London" AS City
  • Arrays of objects

The results look like this:

_time	City	Country	bridges	length	name
08 Mar 2022 3:43:48.000 PM	London	England	{"name":"Tower Bridge","length":801}	801	Tower Bridge

The order of the field names in the output is lexicographical, which is alphabetical and case-sensitive. Internal fields come first, followed by uppercase letters, and finishing with lowercase letters. If you had named the field city instead of City, the city field would appear after the bridges field in the results.

To learn more about lexicographical order, see Lexicographical order in the SPL2 Search Manual.

You can use the flatten command with arrays of objects as well single objects. For additional examples, see flatten command examples.

See also

flatten command

flatten command syntax details

flatten command usage

flatten command examples