Splitting HTTP_Poller JSON Results

Making a call to a system for changes to tickets in a given time period, it returns the results as a single line of JSON. How can I split these out into separate events. Below is the returned results.

{ "result": [{ "u_vendor_ticket_number": "", "parent": "", "made_sla": "true", "caused_by": "", "watch_list": "", "upon_reject": "cancel", "sys_updated_on": "2019-07-18 16:03:04", "u_steps_taken": "", "u_work_request": "false", "child_incidents": "0", "hold_reason": "", "approval_history": "", "number": "pl929", "resolved_by": { "link": "https://example/api/now/table/sys_user/asrgh4b9619a7", "value": "argb9619a7" }, "sys_updated_by": "dtfjd", "opened_by": { "link": "https://example/api/now/table/sys_user/hgha4b96195d", "value": "6arggagag6195d" }, "user_input": "", "sys_created_on": "2019-07-18 15:50:30", "sys_domain": { "link": "https://example/api/now/table/sys_user_group/global", "value": "global" }, "state": "6", "sys_created_by": "argg", "knowledge": "false", "order": "", "calendar_stc": "343", "closed_at": "", "cmdb_ci": "", "impact": "3", "active": "true", "work_notes_list": "", "business_service": { "link": "https://example/api/now/table/cmdb_ci_service/aga9619e5", "value": "garge5" }, "priority": "5", "sys_domain_path": "/", "rfc": "", "time_worked": "", "expected_start": "", "opened_at": "2019-07-18 15:49:05", "business_duration": "1970-01-01 00:05:43", "group_list": "", "work_end": "", "caller_id": { "link": "https://example/api/now/table/sys_user/agawerg9619aa", "value": "8agaga43tg" }, "reopened_time": "", "resolved_at": "2019-07-18 15:54:48", "approval_set": "", "subcategory": "Security Event", "work_notes": "", "short_description": "review.", "close_code": "Request Fulfilled", "correlation_display": "", "work_start": "", "assignment_group": { "link": "https://example/api/now/table/sys_user_group/uig;guik4b961961", "value": "earsg961" }, "additional_assignee_list": "", "business_stc": "343", "description": "", "calendar_duration": "1970-01-01 00:05:43", "close_notes": "delete this email from your inbox an\r\", "notify": "1", "sys_class_name": "incident", "closed_by": "", "follow_up": "", "parent_incident": "", "sys_id": "yuklfkb961944", "contact_type": "email", "reopened_by": "", "incident_state": "6", "urgency": "5", "problem_id": "", "company": { "link": "https://example/api/now/table/core_company/a19", "value": "agag " }, "u_external_ticket": "false", "reassignment_count": "1", "u_responded": "true", "activity_due": "", "assigned_to": "", "severity": "3", "comments": "", "approval": "not requested", "sla_due": "", "u_on_site_support_scheduled_date": "", "u_reported_on_behalf_of": "", "u_webhook": "", "comments_and_work_notes": "", "due_date": "", "sys_mod_count": "5", "reopen_count": "0", "sys_tags": "", "u_alternate_contact_number": "", "escalation": "0", "upon_approval": "proceed", "u_device_tag_number": "", "u_map_url": "", "correlation_id": "", "location": "", "category": "IT" }, { "u_vendor_ticket_number": "", "parent": "", "made_sla": "true", "caused_by": "", "watch_list": "", "upon_reject": "cancel", "sys_updated_on": "2019-07-18 16:04:11", "u_steps_taken": "", "u_work_request": "false", "child_incidents": "0", "hold_reason": "", "approval_history": "", "number": "SLC0029936", "resolved_by": "", "sys_updated_by": "36e95uhy", "opened_by": { "link": "https://example/api/now/table/sys_user/rtegesg", "value": "3456tyghtd" }, "user_input": "", "sys_created_on": "2019-07-18 16:04:11", "sys_domain": { "link": "https://example/api/now/table/sys_user_group/global", "value": "global" }, "state": "1", "sys_created_by": "34tygre", "knowledge": "false", "order": "", "calendar_stc": "", "closed_at": "", "cmdb_ci": "", "impact": "2", "active": "true", "work_notes_list": "", "business_service": { "link": "https://example/api/now/table/cmdb_ci_service/324tgr", "value": "76jthyrt" }, "priority": "5", "sys_domain_path": "/", "rfc": "", "time_worked": "", "expected_start": "", "opened_at": "2019-07-18 16:03:50", "business_duration": "", "group_list": "", "work_end": "", "caller_id": { "link": "https://example/api/now/table/sys_user/4u6hrt", "value": "q34aywhgr" }, "reopened_time": "", "resolved_at": "", "approval_set": "", "subcategory": "", "work_notes": "", "short_description": "ssues", "close_code": "", "correlation_display": "", "work_start": "", "assignment_group": { "link": "https://example/api/now/table/sys_user_group/34tgebs", "value": "q3yhgesbtgd" }, "additional_assignee_list": "", "business_stc": "", "description": "", "calendar_duration": "", "close_notes": "", "notify": "1", "sys_class_name": "incident", "closed_by": "", "follow_up": "", "parent_incident": "", "sys_id": "3wqyehstbgb", "contact_type": "email", "reopened_by": "", "incident_state": "1", "urgency": "5", "problem_id": "", "company": { "link": "https://example/api/now/table/core_company/qta4gwrbszdgx", "value": "t4awgrbszxg" }, "u_external_ticket": "false", "reassignment_count": "0", "u_responded": "true", "activity_due": "", "assigned_to": "", "severity": "3", "comments": "", "approval": "not requested", "sla_due": "", "u_on_site_support_scheduled_date": "", "u_reported_on_behalf_of": "", "u_webhook": "", "comments_and_work_notes": "", "due_date": "", "sys_mod_count": "0", "reopen_count": "0", "sys_tags": "", "u_alternate_contact_number": "", "escalation": "0", "upon_approval": "proceed", "u_device_tag_number": "", "u_map_url": "", "correlation_id": "", "location": "", "category": "IT" }] }

Same stuff, just pretty printed...

{
	"result": [{
		"u_vendor_ticket_number": "",
		"parent": "",
		"made_sla": "true",
		"caused_by": "",
		"watch_list": "",
		"upon_reject": "cancel",
		"sys_updated_on": "2019-07-18 16:03:04",
		"u_steps_taken": "",
		"u_work_request": "false",
		"child_incidents": "0",
		"hold_reason": "",
		"approval_history": "",
		"number": "pl929",
		"resolved_by": {
			"link": "https://example/api/now/table/sys_user/asrgh4b9619a7",
			"value": "argb9619a7"
		},
		"sys_updated_by": "dtfjd",
		"opened_by": {
			"link": "https://example/api/now/table/sys_user/hgha4b96195d",
			"value": "6arggagag6195d"
		},
		"user_input": "",
		"sys_created_on": "2019-07-18 15:50:30",
		"sys_domain": {
			"link": "https://example/api/now/table/sys_user_group/global",
			"value": "global"
		},
		"state": "6",
		"sys_created_by": "argg",
		"knowledge": "false",
		"order": "",
		"calendar_stc": "343",
		"closed_at": "",
		"cmdb_ci": "",
		"impact": "3",
		"active": "true",
		"work_notes_list": "",
		"business_service": {
			"link": "https://example/api/now/table/cmdb_ci_service/aga9619e5",
			"value": "garge5"
		},
		"priority": "5",
		"sys_domain_path": "/",
		"rfc": "",
		"time_worked": "",
		"expected_start": "",
		"opened_at": "2019-07-18 15:49:05",
		"business_duration": "1970-01-01 00:05:43",
		"group_list": "",
		"work_end": "",
		"caller_id": {
			"link": "https://example/api/now/table/sys_user/agawerg9619aa",
			"value": "8agaga43tg"
		},
		"reopened_time": "",
		"resolved_at": "2019-07-18 15:54:48",
		"approval_set": "",
		"subcategory": "Security Event",
		"work_notes": "",
		"short_description": "review.",
		"close_code": "Request Fulfilled",
		"correlation_display": "",
		"work_start": "",
		"assignment_group": {
			"link": "https://example/api/now/table/sys_user_group/uig;guik4b961961",
			"value": "earsg961"
		},
		"additional_assignee_list": "",
		"business_stc": "343",
		"description": "",
		"calendar_duration": "1970-01-01 00:05:43",
		"close_notes": "delete this email from your inbox an\r\",
		"notify": "1",
		"sys_class_name": "incident",
		"closed_by": "",
		"follow_up": "",
		"parent_incident": "",
		"sys_id": "yuklfkb961944",
		"contact_type": "email",
		"reopened_by": "",
		"incident_state": "6",
		"urgency": "5",
		"problem_id": "",
		"company": {
			"link": "https://example/api/now/table/core_company/a19",
			"value": "agag "
		},
		"u_external_ticket": "false",
		"reassignment_count": "1",
		"u_responded": "true",
		"activity_due": "",
		"assigned_to": "",
		"severity": "3",
		"comments": "",
		"approval": "not requested",
		"sla_due": "",
		"u_on_site_support_scheduled_date": "",
		"u_reported_on_behalf_of": "",
		"u_webhook": "",
		"comments_and_work_notes": "",
		"due_date": "",
		"sys_mod_count": "5",
		"reopen_count": "0",
		"sys_tags": "",
		"u_alternate_contact_number": "",
		"escalation": "0",
		"upon_approval": "proceed",
		"u_device_tag_number": "",
		"u_map_url": "",
		"correlation_id": "",
		"location": "",
		"category": "IT"
	},
	{
		"u_vendor_ticket_number": "",
		"parent": "",
		"made_sla": "true",
		"caused_by": "",
		"watch_list": "",
		"upon_reject": "cancel",
		"sys_updated_on": "2019-07-18 16:04:11",
		"u_steps_taken": "",
		"u_work_request": "false",
		"child_incidents": "0",
		"hold_reason": "",
		"approval_history": "",
		"number": "SLC0029936",
		"resolved_by": "",
		"sys_updated_by": "36e95uhy",
		"opened_by": {
			"link": "https://example/api/now/table/sys_user/rtegesg",
			"value": "3456tyghtd"
		},
		"user_input": "",
		"sys_created_on": "2019-07-18 16:04:11",
		"sys_domain": {
			"link": "https://example/api/now/table/sys_user_group/global",
			"value": "global"
		},
		"state": "1",
		"sys_created_by": "34tygre",
		"knowledge": "false",
		"order": "",
		"calendar_stc": "",
		"closed_at": "",
		"cmdb_ci": "",
		"impact": "2",
		"active": "true",
		"work_notes_list": "",
		"business_service": {
			"link": "https://example/api/now/table/cmdb_ci_service/324tgr",
			"value": "76jthyrt"
		},
		"priority": "5",
		"sys_domain_path": "/",
		"rfc": "",
		"time_worked": "",
		"expected_start": "",
		"opened_at": "2019-07-18 16:03:50",
		"business_duration": "",
		"group_list": "",
		"work_end": "",
		"caller_id": {
			"link": "https://example/api/now/table/sys_user/4u6hrt",
			"value": "q34aywhgr"
		},
		"reopened_time": "",
		"resolved_at": "",
		"approval_set": "",
		"subcategory": "",
		"work_notes": "",
		"short_description": "ssues",
		"close_code": "",
		"correlation_display": "",
		"work_start": "",
		"assignment_group": {
			"link": "https://example/api/now/table/sys_user_group/34tgebs",
			"value": "q3yhgesbtgd"
		},
		"additional_assignee_list": "",
		"business_stc": "",
		"description": "",
		"calendar_duration": "",
		"close_notes": "",
		"notify": "1",
		"sys_class_name": "incident",
		"closed_by": "",
		"follow_up": "",
		"parent_incident": "",
		"sys_id": "3wqyehstbgb",
		"contact_type": "email",
		"reopened_by": "",
		"incident_state": "1",
		"urgency": "5",
		"problem_id": "",
		"company": {
			"link": "https://example/api/now/table/core_company/qta4gwrbszdgx",
			"value": "t4awgrbszxg"
		},
		"u_external_ticket": "false",
		"reassignment_count": "0",
		"u_responded": "true",
		"activity_due": "",
		"assigned_to": "",
		"severity": "3",
		"comments": "",
		"approval": "not requested",
		"sla_due": "",
		"u_on_site_support_scheduled_date": "",
		"u_reported_on_behalf_of": "",
		"u_webhook": "",
		"comments_and_work_notes": "",
		"due_date": "",
		"sys_mod_count": "0",
		"reopen_count": "0",
		"sys_tags": "",
		"u_alternate_contact_number": "",
		"escalation": "0",
		"upon_approval": "proceed",
		"u_device_tag_number": "",
		"u_map_url": "",
		"correlation_id": "",
		"location": "",
		"category": "IT"
	}]
}

Provided you insert an n before that closing quote, so the JSON can be parsed, you can split it into two events using

split { field => "result" }
1 Like

Awesome...one last question...is it possible to have the fields not be under result? For instance, result.opened_by but I need it to be opened_by.

Yes, you can move all the keys to the root using code like this.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.