title: how do I extract keys from a JSON object?
body: <p>My splunk instance queries a database once an hour for data about products, and gets a JSON string back that is structured like this:</p>
  <pre><code>{&quot;counts&quot;:
      {&quot;green&quot;:413,
       &quot;red&quot;:257,
       &quot;total&quot;:670,
       &quot;product_list&quot;:
          { &quot;urn:product:1&quot;:{ 
              &quot;name&quot;:&quot;M &amp; Ms&quot; ,
              &quot;total&quot;:332 ,
              &quot;green&quot;:293 ,
              &quot;red&quot;:39 } ,
            &quot;urn:product:2&quot;:{ 
              &quot;name&quot;:&quot;Christmas Ornaments&quot; ,
              &quot;total&quot;:2 ,
              &quot;green&quot;:0 ,
              &quot;red&quot;:2 } ,
           &quot;urn:product:3&quot;:{ 
              &quot;name&quot;:&quot;Traffic Lights&quot; ,
              &quot;total&quot;:1 ,
              &quot;green&quot;:0 ,
              &quot;red&quot;:1 } ,
           &quot;urn:product:4&quot;:{ 
              &quot;name&quot;:&quot;Stop Signs&quot; ,
              &quot;total&quot;:2 ,
              &quot;green&quot;:0 ,
              &quot;red&quot;:2 },
              ...
          }
      }
  }
  </code></pre>
  <p>I have a query that alerts when the counts.green drops by 10% over 24 hours:</p>
  <pre><code>index=database_catalog source=RedGreenData | head 1 
  | spath path=counts.green output=green_now
  | table green_now
  | join host
      [| search index=database_catalog source=RedGreenData latest=-1d | head 1 | spath path=counts.green output=green_yesterday
      | table green_yesterday]
  | where green_yesterday &gt; 0
  | eval delta=(green_yesterday - green_now)/green_yesterday * 100 
  | where delta &gt; 10 
  </code></pre>
  <p>While I'm an experienced developer in C, C++, Java, SQL, JavaScript, and several others, I'm fairly new to Splunk's Search Processing Language, and references and tutorials seem pretty light, at least the ones I've found.</p>
  <p>My next story is to at least expose all the individual products, and identify which ones have a 10% drop over 24 hours.</p>
  <p>I thought a reasonable learning exercise would be to extract the names of all the products, and eventually turn that into a table with name, product code (e.g. urn:product:4), green count today, green count 24 hours ago, and then filter that on a 10% drop for all products where yesterday's count is positive.  And I'm stuck.  The references to {} are all for a JSON array [], not a JSON object with keys and values.</p>
  <p>I'd love to get a table out that looks something like this:</p>
  <div class="s-table-container">
  <table class="s-table">
  <thead>
  <tr>
  <th>ID</th>
  <th>Name</th>
  <th>Green</th>
  <th>Red</th>
  <th>Total</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>urn:product:1</td>
  <td>M &amp; Ms</td>
  <td>293</td>
  <td>39</td>
  <td>332</td>
  </tr>
  <tr>
  <td>urn:product:2</td>
  <td>Christmas Ornaments</td>
  <td>0</td>
  <td>2</td>
  <td>2</td>
  </tr>
  <tr>
  <td>urn:product:3</td>
  <td>Traffic Lights</td>
  <td>0</td>
  <td>1</td>
  <td>1</td>
  </tr>
  <tr>
  <td>urn:product:4</td>
  <td>Stop Signs</td>
  <td>0</td>
  <td>2</td>
  <td>2</td>
  </tr>
  </tbody>
  </table>
  </div>
  <p>How do I do that?</p>